CVE-2024-27298: SQL Injection Vulnerability in parse-server
Summary
CVE-2024-27298: Parse Server literalizeRegexPart SQL Injection. Affects parse versions < 6.5.0. Fixed in 6.5.0. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2024-27298 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
parse-server is a Parse Server for Node.js / Express. It is a backend framework that allows developers to build scalable and secure applications. The framework uses the PostgreSQL database for data storage. This vulnerability specifically affects parse-server when it is configured to use PostgreSQL.
Vulnerability Detail
This vulnerability allows for SQL injection attacks when Parse Server is configured to use the PostgreSQL database. An attacker can manipulate user input to inject malicious SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation. The vulnerability has been fixed in versions 6.5.0 and 7.0.0-alpha.20 of parse-server.
How To Fix
Minimum fixed version
6.5.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update parse-server to the fixed versions as soon as possible.
Conclusion
The SQL injection vulnerability in parse-server when configured to use PostgreSQL can lead to unauthorized access, data leakage, or data manipulation. It is crucial to update parse-server to versions 6.5.0 or 7.0.0-alpha.20 to mitigate this vulnerability. If you need further support or guidance, you can contact DevNack.com for assistance.
See every vulnerability recorded for parse →
FAQ
parse-server is a backend framework for Node.js / Express that allows developers to build scalable and secure applications.
SQL injection is a type of security vulnerability where an attacker can manipulate user input to inject malicious SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
There are no known public exploits for this vulnerability at the moment. However, it is crucial to update parse-server to the fixed versions to prevent any potential attacks.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in fixing the vulnerability in your parse-server installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
