CVE-2022-39396: Remote Code Execution in Parse Server
Summary
CVE-2022-39396: Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser. Affects parse across 2 version ranges.
< 4.10.18
>= 5.0.0, < 5.3.1
Fixed in 4.10.18 or 5.3.1, depending on the release line you run. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2022-39396 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open source backend that can be deployed to any infrastructure running Node.js. It provides a platform for building scalable and secure applications. However, versions prior to 4.10.18 and 5.3.1 on the 5.X branch are vulnerable to remote code execution through prototype pollution in the MongoDB BSON parser.
Vulnerability Detail
The vulnerability arises from a prototype pollution sink in Parse Server, which allows an attacker to manipulate the prototype of an object and inject malicious code. By exploiting this vulnerability, an attacker can execute arbitrary code remotely. This can lead to unauthorized access, data breaches, and potential compromise of the entire system. The issue has been patched in versions 4.10.18 and 5.3.1.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.10.184.10.18 -
>= 5.0.0, < 5.3.15.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
Parse Server versions prior to 4.10.18 and 5.3.1 are vulnerable to remote code execution through prototype pollution. It is crucial to update to the patched versions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for parse →
FAQ
Parse Server is an open source backend that allows developers to build scalable and secure applications using Node.js.
Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to unexpected behavior and potential security issues.
By manipulating the prototype of an object in Parse Server, an attacker can inject malicious code and execute it remotely, potentially compromising the system.
No, there are no known workarounds for this vulnerability. It is recommended to update Parse Server to the patched versions.
The vulnerability can lead to unauthorized access, data breaches, and complete compromise of the affected system.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
