CVE-2021-44908: Prototype Pollution in Sails.js
Summary
CVE-2021-44908: Prototype Pollution in Sails.js. Affects sails versions < 1.5.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Sails.js is a Node.js web application framework that follows the Model-View-Controller (MVC) architectural pattern. It provides a robust set of features for building scalable and maintainable web applications. Sails.js allows developers to create controllers that handle incoming requests and define actions to be performed. These actions can be loaded dynamically using the loadActionModules() function.
Vulnerability Detail
Sails.js versions up to 1.5.2 are vulnerable to Prototype Pollution. This vulnerability occurs in the loadActionModules() function in the controller/load-action-modules.js file. By manipulating the request parameters, an attacker can inject malicious properties into the prototype of an object, leading to unexpected behavior or code execution. This can have severe consequences, such as unauthorized access, data tampering, or denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to the latest version is not feasible, a temporary workaround is to sanitize and validate the request parameters before using them. This can be done by implementing input validation and filtering techniques to ensure that only safe and expected values are used.
Conclusion
In conclusion, Sails.js versions up to 1.5.2 are vulnerable to Prototype Pollution. It is crucial to upgrade to the latest version or apply the provided patch to mitigate the risk of unauthorized access, data tampering, or denial of service. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for sails →
FAQ
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to unexpected behavior or code execution. By injecting malicious properties into the prototype, an attacker can manipulate the behavior of the application.
The potential consequences of this vulnerability include unauthorized access, data tampering, and denial of service. An attacker can exploit the vulnerability to execute arbitrary code or modify critical application data.
At the time of this advisory, there is no known public exploit for this vulnerability. However, it is important to apply the patch or upgrade to the latest version to mitigate the risk.
No, only Sails.js versions up to 1.5.2 are affected by this vulnerability. It is recommended to check your project's version and upgrade if necessary.
Yes, you can find more information about this vulnerability in the Sails.js GitHub repository advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-8v3j-jfg3-v3fv/GHSA-8v3j-jfg3-v3fv.json
References
Related vulnerabilities
Recent vulnerabilities recorded for sails.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
