CVE-2018-21036 Improper Input Validation in sails-hook-sockets
Attackers can cause a denial of service in Sails.js applications by sending a WebSocket request with an empty pathname due to missing error handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-21036?
CVE-2018-21036 is a high-severity denial of service vulnerability in n/a, published on 21 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hook-sockets to handle an empty pathname in a WebSocket request.
Weakness: CWE-20
Which versions are affected by CVE-2018-21036?
2 open source packages ship an affected version, including sails-hook-sockets. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sails-hook-sockets npm | All versions | 1.5.5 |
sails-hook-sockets npm | All versions | 1.5.5 |
Products include Sailsjs Sails.
How do I fix CVE-2018-21036?
Upgrade sails-hook-sockets to 1.5.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-21036 being exploited?
There is no known exploitation of CVE-2018-21036 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-f7f4-hqp2-7prc.