CVE-2023-38504— Sails DoS vulnerability for apps with sockets enabled
Quick assessment
Affected
balderdashy sails
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Sails.js是美国Sails公司的一款基于Node.js的Web应用程序框架。 Sails.js 1.5.7 之前版本存在安全漏洞，该漏洞源于在Sails 应用程序中，攻击者可以发送虚拟请求，导致节点进程崩溃。
Possible ATT&CK Techniques 1 AI
T1211 · Exploitation for Stealth
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-38504
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Sails DoS vulnerability for apps with sockets enabled
Source: CVE Program / CVE List V5
Vulnerability Description
Sails is a realtime MVC Framework for Node.js. In Sails apps prior to version 1.5.7,, an attacker can send a virtual request that will cause the node process to crash. This behavior was fixed in Sails v1.5.7. As a workaround, disable the sockets hook and remove the `sails.io.js` client.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未捕获的异常
Source: CVE Program / CVE List V5
Vulnerability Title
Sails.js 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Sails.js是美国Sails公司的一款基于Node.js的Web应用程序框架。 Sails.js 1.5.7 之前版本存在安全漏洞，该漏洞源于在Sails 应用程序中，攻击者可以发送虚拟请求，导致节点进程崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| balderdashy | sails | < 1.5.7 | - |
|
II. Public POCs for CVE-2023-38504
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Verified env
Premium
Qwen3.6-35B-A3B
· 5800 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2023-38504
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-38504 (2)
-
https://github.com/balderdashy/sails/pull/7287 x_refsource_MISC
Vendor Advisories for CVE-2023-38504 (1)
-
https://github.com/balderdashy/sails/security/advisories/GHSA-gpw9-fwm8-7rx7 x_refsource_CONFIRM
Other References for CVE-2023-38504 (1)
-
https://github.com/balderdashy/sails/releases/tag/v1.5.7 x_refsource_MISC
IV. Related Vulnerabilities
Same weakness: CWE-248
-
CVE-2026-77781
Tie::Hash::Regex versions before 2.0.0 for Perl will throw a -
CVE-2026-53530
ratex-parser panics on `\verb` with a multibyte delimiter (U -
CVE-2026-52731
ZEBRA: Full node denial of service via non-ASCII LongPollId -
CVE-2026-52738
ZEBRA: Finalized address balance credit-first overflow on co -
CVE-2026-52739
ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Ze
V. Comments for CVE-2023-38504
No comments yet