CVE-2018-21036: Improper Input Validation in sails-hook-sockets
Summary
CVE-2018-21036: Improper Input Validation in sails-hook-sockets. Affects sails-hook-sockets versions < 1.5.5. Fixed in 1.5.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sails-hook-sockets is an npm package that provides WebSocket support for Sails.js, a web application framework for Node.js. It allows developers to easily integrate real-time communication capabilities into their Sails.js applications. However, versions of sails-hook-sockets prior to v1.0.0-46 are vulnerable to an improper input validation issue.
Vulnerability Detail
The vulnerability in sails-hook-sockets arises from the absence of an error handler to handle an empty pathname in a WebSocket request. This allows an attacker to exploit the vulnerability by sending a single request with an empty pathname, leading to a denial of service (DoS) condition. The lack of proper input validation can cause the application to crash or become unresponsive, impacting its availability.
How To Fix
Minimum fixed version
1.5.5
This is the first release that contains the fix.
npm install sails-hook-sockets@1.5.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the package to the fixed version as soon as possible.
Conclusion
In conclusion, the sails-hook-sockets package prior to v1.0.0-46 is vulnerable to an improper input validation issue that can lead to a denial of service (DoS) condition. It is crucial for developers to update to version 1.5.5 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sails-hook-sockets →
FAQ
The vulnerability can be exploited to cause a denial of service (DoS) condition, potentially leading to application crashes or unresponsiveness.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will provide real-time alerts for open-source vulnerabilities.
There are no known instances of this vulnerability being exploited in the wild at the time of this advisory.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-f7f4-hqp2-7prc/GHSA-f7f4-hqp2-7prc.json).
References
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.