CVE-2022-24760: Remote Code Execution (RCE) in Parse Server
Summary
CVE-2022-24760: Command Injection in Parse server. Affects parse versions < 4.10.7. Fixed in 4.10.7. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2022-24760 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Parse Server is an open source http web server backend that is commonly used with MongoDB as the default database. It provides functionality for managing and querying data, as well as handling user authentication and push notifications. However, versions prior to 4.10.7 of Parse Server are vulnerable to Remote Code Execution (RCE). This vulnerability stems from a Prototype Pollution issue in the DatabaseController.js file, which can be exploited to execute arbitrary code. The vulnerability affects both Linux (Ubuntu) and Windows systems. It is crucial for users to upgrade to the latest version to mitigate the risk.
Vulnerability Detail
The vulnerability in Parse Server allows an attacker to execute arbitrary code remotely. By exploiting the Prototype Pollution issue in the DatabaseController.js file, an attacker can modify the prototype of objects, leading to unexpected behavior and potential code execution. This vulnerability affects Parse Server in the default configuration with MongoDB, but it may also impact other database backends like Postgres. The impact of this vulnerability is severe, as it grants an attacker the ability to execute arbitrary code with the privileges of the Parse Server process. This can result in unauthorized access, data breaches, and further compromise of the host system.
How To Fix
Minimum fixed version
4.10.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading immediately is not feasible, a temporary workaround is available. Users can manually patch their installation by applying the code provided in the source GHSA-p6h4-93qp-jhcm. This workaround should be considered a temporary solution until the system can be upgraded to a fixed version.
Conclusion
The Remote Code Execution vulnerability in Parse Server poses a significant risk to systems running affected versions. It is crucial for users to upgrade to version 4.10.7 or later to mitigate this vulnerability. Alternatively, users can apply the provided workaround until they are able to upgrade. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for parse →
FAQ
Parse Server is an open source http web server backend that provides functionality for managing and querying data, user authentication, and push notifications.
Remote Code Execution is a vulnerability that allows an attacker to execute arbitrary code on a target system, potentially leading to unauthorized access, data breaches, and further compromise.
The Prototype Pollution vulnerability in Parse Server's DatabaseController.js file allows an attacker to modify the prototype of objects, leading to unexpected behavior and potential code execution.
Versions prior to 4.10.7 of Parse Server are affected by this vulnerability.
The impact of this vulnerability is severe, as it allows an attacker to execute arbitrary code with the privileges of the Parse Server process. This can result in unauthorized access, data breaches, and further compromise of the host system.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
