Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Informational severity, published 25 February 2021.
- Which products and versions are affected?
- sails (npm) SEMVER:introduced=0,fixed=0.12.0.
- Is there a fix for This vulnerability?
- Yes. sails (npm): upgrade to 0.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network, in a software library.
- Am I affected?
- Check whether you run sails (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- sails (npm): upgrade to 0.12.0 or later
npm install sails@0.12.0
Technical details
The vulnerability exists in Sails' response object handler, specifically the res.set() method in lib/router/res.js. When Express' router processes an OPTIONS request for an undefined route, it expects res.set() to be chainable (return 'this'), but Sails' implementation returned the value instead, causing an infinite loop. This occurs due to Sails using a constructed response object that does not fully comply with Express' expectations. An attacker can trigger this via a socket.io REST interface by sending an OPTIONS request to any undefined route. The fix, merged in commit 252b7b8, makes res.set() chainable by returning 'this' instead of the value, resolving the infinite loop and preventing the crash.
Affected products
- Balderdashy Sails all versions before 0.12.0
Timeline
- 2019-06-20: patched: Fix merged in commit 252b7b8; fixed in version 0.12.0
- 2021-02-25: disclosed