Executive brief
Sails.js is a web application framework that includes a WebSocket module for real-time communication. A flaw in the sails-hook-sockets component fails to validate empty WebSocket request paths, allowing an attacker to crash the application with a single malicious request, causing service unavailability.
Technical details
This vulnerability is an improper input validation flaw (CWE-20) in the sails-hook-sockets library affecting Sails.js versions before 1.0.0-46. The root cause is missing error handling for WebSocket requests with an empty pathname—url.parse() returns null for such requests, which is then passed to .match() operations expecting a string, causing a runtime error. An attacker can exploit this by sending a WebSocket message with an empty path, requiring only network access to the application (no authentication needed). The attack causes immediate denial of service by crashing the socket handler. The fix, available in sails-hook-sockets 1.5.5 and Sails.js 1.0.0-46+, adds a fallback to '/' when pathname is null, ensuring proper string handling.
Affected products
- Sails.js sails-hook-sockets before 1.5.5
Timeline
- 2020-07-21: disclosed: CVE-2018-21036 published on NVD
- 2020-07-24: advisory: GHSA-f7f4-hqp2-7prc published
- 2020-07-24: patched: Fix available in sails-hook-sockets 1.5.5 and Sails.js 1.0.0-46+