Is CVE-2021-44908 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-44908 being exploited in the wild.

How severe is CVE-2021-44908?

Low severity, with a CVSS score of 3.1, published 18 March 2022.

Which products and versions are affected?

sails (npm) SEMVER:introduced=0,last_affected=1.5.2; Sails.js through 1.5.2.

Is there a fix for CVE-2021-44908?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2021-44908 attacked?

It is attacked over the network.

Am I affected by CVE-2021-44908?

Check whether you run sails (npm) or Sails.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-44908: Sails.js prototype pollution in action module loading

CVE-2021-44908 · Severity: low · CVSS 3.1 · Published 2022-03-18

Sails.js is a popular Node.js web framework used to build server applications. A prototype pollution vulnerability in its action module loader allows attackers to inject arbitrary properties into JavaScript objects, potentially causing application crashes or allowing property injection attacks that could bypass security controls or modify application behavior.

Technologies: sails (npm). Vendors: npm.

Quick answers

Is CVE-2021-44908 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-44908 being exploited in the wild.
How severe is CVE-2021-44908?: Low severity, with a CVSS score of 3.1, published 18 March 2022.
Which products and versions are affected?: sails (npm) SEMVER:introduced=0,last_affected=1.5.2; Sails.js through 1.5.2.
Is there a fix for CVE-2021-44908?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2021-44908 attacked?: It is attacked over the network.
Am I affected by CVE-2021-44908?: Check whether you run sails (npm) or Sails.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a prototype pollution flaw (CWE-1321) in the loadActionModules() function within controller/load-action-modules.js. The vulnerable code at lines 134–165 performs unsafe object assignment when processing action file paths; if an application dynamically controls the filePath variable, an attacker can supply a path traversal or specially crafted value that pollutes the JavaScript object prototype. No authentication or user interaction is required—the vulnerability is triggered via network-reachable input. An attacker can cause denial of service by crashing the application or inject arbitrary properties to bypass security controls or alter application logic. A patch is available in the master branch of the Sails.js GitHub repository.

Affected products

Sails.js Sails.js through 1.5.2

Identifiers

CVE-2021-44908
GHSA-8v3j-jfg3-v3fv

Timeline

2022-03-15: disclosed: Vulnerability reported on GitHub issue #7209
2022-03-17: advisory: CVE-2021-44908 published on NVD
2022-03-18: advisory: GHSA-8v3j-jfg3-v3fv advisory published

References

https://github.com/balderdashy/sails/issues/7209

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.