CVE-2023-38504 Sails DoS vulnerability for apps with sockets enabled
An attacker can crash the Node.js process by sending a malicious virtual request in Sails apps with sockets enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-38504?
CVE-2023-38504 is a high-severity denial of service vulnerability in balderdashy sails, published on 27 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sails is a realtime MVC Framework for Node.js. In Sails apps prior to version 1.5.7,, an attacker can send a virtual request that will cause the node process to crash. This behavior was fixed in Sails v1.5.7. As a workaround, disable the sockets hook and remove the `sails.io.js` client.
Weakness: CWE-248
Which versions are affected by CVE-2023-38504?
2 open source packages ship an affected version, including sails. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sails npm | All versions | 1.5.7 |
sails npm | All versions | 1.5.7 |
Products include Sailsjs Sails.
How do I fix CVE-2023-38504?
Upgrade sails to 1.5.7 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-38504 being exploited?
There is no known exploitation of CVE-2023-38504 in the wild and no public exploit code.
Other vulnerabilities in balderdashy sails
Sources
Also known as GHSA-gpw9-fwm8-7rx7.