CVE-2018-21036: 
JavaScript vulnerability analysis and mitigation

CVE-2018-21036 affects Sails.js versions before v1.0.0-46 and sails-hook-sockets versions before 1.5.5. The vulnerability allows attackers to cause a denial of service with a single request due to a missing error handler in sails-hook-sockets that fails to properly handle empty pathnames in WebSocket requests. The vulnerability was disclosed on July 19, 2020 (OSS Security).

The vulnerability stems from the absence of proper error handling for empty pathname values in WebSocket requests within the sails-hook-sockets component. The issue was addressed by implementing proper path handling in the socket requests, ensuring that req.path is properly defined and stringified. The fix involved adding URL parsing functionality and setting a default path value of '/' when an empty pathname is encountered (Sails Hook Sockets Patch). The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 HIGH with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can cause a denial of service condition in the affected Sails.js application. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (NVD).

The vulnerability can be exploited by making a request with a malformed URL to the socket. A proof of concept exists that demonstrates the exploit by executing 'io.socket.get('?')' in the browser console after setting up a default Sails application (OSS Security).

The vulnerability has been fixed in Sails.js version 1.0.0-46 and sails-hook-sockets version 1.5.5. Users should upgrade to these or later versions to mitigate the vulnerability. The fix involves proper handling of empty pathnames in WebSocket requests by setting a default path value (Sails Hook Sockets Patch).