CVE-2022-41878
Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that are specified in the Parse Server option `requestKeywordDenylist` can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the `requestKeywordDenylist` option. This issue is fixed in versions 4.10.19, and 5.3.2. If upgrade is not possible, the following Workarounds may be applied: Configure your firewall to only allow trusted servers to make request to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature.
Parse Server es un backend de código abierto que se puede implementar en cualquier infraestructura que pueda ejecutar Node.js. En versiones anteriores a la 5.3.2 o 4.10.19, las palabras clave que se especifican en la opción del servidor Parse `requestKeywordDenylist` se pueden inyectar a través de activadores o webhooks de Cloud Code. Esto dará como resultado que la palabra clave se guarde en la base de datos, sin pasar por la opción `requestKeywordDenylist`. Este problema se solucionó en las versiones 4.10.19 y 5.3.2. Si la actualización no es posible, se pueden aplicar workarounds: Configure su firewall para permitir que solo los servidores confiables realicen solicitudes a la API de Webhooks de Parse Server Cloud Code, o bloquee la API por completo si no está utilizando la función.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Parse Server. Authentication is required to exploit this vulnerability.
The specific flaw exists within the buildUpdatedObject function. The issue results from the lack of control over modifications to attributes of object prototypes. An attacker can leverage this vulnerability to execute code in the context of the service account.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-09-30 CVE Reserved
- 2022-11-10 CVE Published
- 2024-08-03 CVE Updated
- 2024-10-09 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CAPEC
References (1)
| URL | Tag | Source |
|---|---|---|
| https://github.com/parse-community/parse-server/security/advisories/GHSA-xprv-wvh7-qqqx | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Parseplatform Search vendor "Parseplatform" | Parse-server Search vendor "Parseplatform" for product "Parse-server" | < 4.10.19 Search vendor "Parseplatform" for product "Parse-server" and version " < 4.10.19" | node.js |
Affected
| ||||||
| Parseplatform Search vendor "Parseplatform" | Parse-server Search vendor "Parseplatform" for product "Parse-server" | >= 5.0.0 < 5.3.2 Search vendor "Parseplatform" for product "Parse-server" and version " >= 5.0.0 < 5.3.2" | node.js |
Affected
| ||||||