In Specs We Trust? Conformance-Analysis of Implementation to Specifications in Node-RED and Associated Security Risks

Low-code development frameworks for IoT platforms offer a simple drag-and-drop mechanism to create applications for the billions of existing IoT devices without the need for extensive programming knowledge. The security of such software is crucial given the close integration of IoT devices in many highly sensitive areas such as healthcare or home automation. Node-RED is a framework to build applications from nodes that are contributed by open-source developers. Its reliance on unvetted contributions and lack of security checks raises the concern that the applications could be vulnerable to attacks, thereby posing a security risk to end users. The low-code approach could imply that users lack the technical knowledge to mitigate or even realize such security concerns. This paper focuses on hidden information flows in Node-RED nodes, meaning flows that are not captured by the specifications. They could (unknowingly or with malicious intent) cause leaks of sensitive information to unauthorized entities. We report the results of a conformance analysis of all nodes in the Node-RED framework, for which we compared the numbers of specified inputs and outputs of each node against the number of sources and sinks detected with CodeQL. The results show, that 55% of all nodes exhibit more possible flows than are specified. A risk assessment of a subset of the nodes showed, that 28% of them are associated with a high severity and 36% with a medium severity rating.