Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2023-38504

HIGH
Published 2023-07-27T18:12:05.419Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2023-38504. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1
7.5
/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score Metrics
Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14
0.002
probability
of exploitation in the wild

There is a 0.2% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25
Exploit Probability
Percentile: 0.451
Higher than 45.1% of all CVEs

Attack Vector Metrics

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED

Impact Metrics

Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Description

Sails is a realtime MVC Framework for Node.js. In Sails apps prior to version 1.5.7,, an attacker can send a virtual request that will cause the node process to crash. This behavior was fixed in Sails v1.5.7. As a workaround, disable the sockets hook and remove the `sails.io.js` client.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

balderdashy

sails

Affected Versions:

< 1.5.7
sailsjs

sails

Affected Versions:

0

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed HIGH

DoS vulnerability for apps with sockets enabled

GHSA-gpw9-fwm8-7rx7

Advisory Details

### Impact In Sails apps <=v1.5.6, an attacker can send a virtual request that will cause the node process to crash. ### Patches This behavior was fixed in Sails [v1.5.7](https://github.com/balderdashy/sails/releases/tag/v1.5.7) ### Workarounds Disable the sockets hook and remove the `sails.io.js` client ### References https://github.com/balderdashy/sails/pull/7287 Big thanks to @ThomasRinsma at [Codean](https://www.linkedin.com/company/codeanio/)!

Affected Packages

npm sails
ECOSYSTEM: ≥0 <1.5.7

CVSS Scoring

CVSS Score

7.5

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

WEB https://github.com/balderdashy/sails/security/advisories/GHSA-gpw9-fwm8-7rx7
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-38504
WEB https://github.com/balderdashy/sails/pull/7287
WEB https://github.com/balderdashy/sails/commit/4a023dc5095a4b30fdc8535f705ed34cd22d2f7d
PACKAGE https://github.com/balderdashy/sails
WEB https://github.com/balderdashy/sails/releases/tag/v1.5.7

Advisory provided by GitHub Security Advisory Database. Published: July 27, 2023, Modified: July 27, 2023

References

https://github.com/balderdashy/sails/security/advisories/GHSA-gpw9-fwm8-7rx7
https://github.com/balderdashy/sails/pull/7287
https://github.com/balderdashy/sails/commit/4a023dc5095a4b30fdc8535f705ed34cd22d2f7d
https://github.com/balderdashy/sails/releases/tag/v1.5.7
Published: 2023-07-27T18:12:05.419Z
Last Modified: 2024-10-03T18:39:16.029Z
Copied to clipboard!