CVE-2021-44908
📋 TL;DR
This CVE describes a prototype pollution vulnerability in Sails.js versions up to 1.4.0 that allows attackers to modify JavaScript object prototypes. This can lead to remote code execution, denial of service, or privilege escalation. All applications using vulnerable Sails.js versions are affected.
💻 Affected Systems
- Sails.js
📦 What is this software?
Sails by Sailsjs
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, and lateral movement within the network.
Likely Case
Denial of service, privilege escalation, or arbitrary code execution within the application context.
If Mitigated
Limited impact if proper input validation and security controls prevent exploitation attempts.
🎯 Exploit Status
Proof of concept code is publicly available, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.1
Vendor Advisory: https://github.com/balderdashy/sails/issues/7209
Restart Required: Yes
Instructions:
1. Update Sails.js to version 1.4.1 or later using npm update sails. 2. Restart the application server. 3. Verify the update was successful.
🔧 Temporary Workarounds
Input validation middleware
allImplement strict input validation to prevent malicious payloads from reaching vulnerable functions
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block prototype pollution patterns
- Isolate vulnerable applications in network segments with strict access controls
🔍 How to Verify
Check if Vulnerable:
Check package.json for Sails.js version <=1.4.0 or run npm list sails in the application directoryCheck Version:
npm list sails | grep sailsVerify Fix Applied:
Verify Sails.js version is 1.4.1 or higher using npm list sails📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript object modifications
- Unexpected prototype property assignments
- Application crashes with prototype-related errors
Network Indicators:
- HTTP requests with unusual JSON payloads containing __proto__ or constructor properties
SIEM Query:
source="application.logs" AND ("__proto__" OR "constructor" OR "prototype pollution")🔗 References
- https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/sailsJS%20PoC.zip
- https://github.com/balderdashy/sails/blob/master/lib/app/private/controller/load-action-modules.js#L32
- https://github.com/balderdashy/sails/issues/7209
- https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/sailsJS%20PoC.zip
- https://github.com/balderdashy/sails/blob/master/lib/app/private/controller/load-action-modules.js#L32
- https://github.com/balderdashy/sails/issues/7209
