CVE-2022-39396
Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.18, and prior to 5.3.1 on the 5.X branch, are vulnerable to Remote Code Execution via prototype pollution. An attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. This issue is patched in version 5.3.1 and in 4.10.18. There are no known workarounds.
Parse Server es un backend de código abierto que se puede implementar en cualquier infraestructura que pueda ejecutar Node.js. Las versiones anteriores a la 4.10.18 y anteriores a la 5.3.1 en la rama 5.X son vulnerables a la ejecución remota de código a través de la contaminación de prototipos. Un atacante puede utilizar este prototipo de sumidero de contaminación para desencadenar una ejecución remota de código a través del analizador BSON de MongoDB. Este problema se solucionó en la versión 5.3.1 y 4.10.18. No se conocen workarounds.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Parse Server. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the transformUpdate function. The issue results from the lack of control over modifications to attributes of object prototypes. An attacker can leverage this vulnerability to execute code in the context of the service account.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-09-02 CVE Reserved
- 2022-11-10 CVE Published
- 2024-06-17 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CAPEC
References (1)
| URL | Tag | Source |
|---|---|---|
| https://github.com/parse-community/parse-server/security/advisories/GHSA-prm5-8g2m-24gg | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Parseplatform Search vendor "Parseplatform" | Parse-server Search vendor "Parseplatform" for product "Parse-server" | < 4.10.18 Search vendor "Parseplatform" for product "Parse-server" and version " < 4.10.18" | node.js |
Affected
| ||||||
| Parseplatform Search vendor "Parseplatform" | Parse-server Search vendor "Parseplatform" for product "Parse-server" | >= 5.0.0 < 5.3.1 Search vendor "Parseplatform" for product "Parse-server" and version " >= 5.0.0 < 5.3.1" | node.js |
Affected
| ||||||