Executive brief
Sails is a popular web application framework for Node.js. Versions before 0.12.7 can be misconfigured to allow cross-origin requests from any website, bypassing the browser's Same Origin Policy and enabling attackers to make unauthorized API calls on behalf of authenticated users through malicious web pages.
Technical details
The vulnerability is a broken CORS (Cross-Origin Resource Sharing) configuration issue in Sails framework. When allRoutes is set to true and origin is set to "*" or left commented out, the server reflects the origin header value directly into the Access-Control-Allow-Origin response header without proper validation. This allows any origin to make cross-domain requests. The attack requires the vulnerable configuration to be active (allRoutes: true with origin: "*") and is primarily a configuration error rather than a code defect. The fix in 0.12.7 adds console warnings when overly-permissive CORS settings are detected in production, placing the responsibility on users to configure CORS properly. Patched in version 0.12.7.
Affected products
- Sails Sails before 0.12.7
Timeline
- 2019-02-18: disclosed