Executive brief
Sails is a popular Node.js web application framework. A denial of service vulnerability exists where sending an OPTIONS request to an undefined route causes the application to become unresponsive or crash. An attacker can exploit this remotely by sending a specially crafted request, disrupting service availability for all users.
Technical details
The vulnerability exists in Sails' response object handler, specifically the res.set() method in lib/router/res.js. When Express' router processes an OPTIONS request for an undefined route, it expects res.set() to be chainable (return 'this'), but Sails' implementation returned the value instead, causing an infinite loop. This occurs due to Sails using a constructed response object that does not fully comply with Express' expectations. An attacker can trigger this via a socket.io REST interface by sending an OPTIONS request to any undefined route. The fix, merged in commit 252b7b8, makes res.set() chainable by returning 'this' instead of the value, resolving the infinite loop and preventing the crash.
Affected products
- Balderdashy Sails all versions before 0.12.0
Timeline
- 2019-06-20: patched: Fix merged in commit 252b7b8; fixed in version 0.12.0
- 2021-02-25: disclosed