PT-2022-12261 · Sails.Js · Sails.Js

Marynko · Published 2022-03-17 · Updated 2022-03-24 · CVE-2021-44908

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sails.js versions <= 1.5.2

Description The issue is related to Prototype Pollution via the controller/load-action-modules.js file, specifically the loadActionModules() function. This affects Sails.js and can be exploited due to the vulnerable function.

Recommendations For versions <= 1.5.2, update to a version that includes the fix available in the master branch of Sails.js's GitHub repository. As a temporary workaround, consider disabling the loadActionModules() function until a patch is available.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2021-44908

GHSA-8V3J-JFG3-V3FV

Affected Products

Sails.Js

References · 9

• 🔥 https://github.com/balderdashy/sails/issues/7209 · Exploit
• 🔥 https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/sailsJS%20PoC.zip · Exploit
• https://osv.dev/vulnerability/CVE-2021-44908 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8v3j-jfg3-v3fv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44908 · Security Note
• https://github.com/balderdashy/sails · Note
• https://github.com/balderdashy/sails/commit/7c5379a656bb305c958df1dcc2b51a9668830358 · Note
• https://github.com/balderdashy/sails/blob/master/lib/app/private/controller/load-action-modules.js#L32 · Note
• https://t.me/cibsecurity/39132 · Telegram Post