CVE-2022-41879
Parse Server subject to Prototype pollution via Cloud Code Webhooks
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.3 or 4.10.20, a compromised Parse Server Cloud Code Webhook target endpoint allows an attacker to use prototype pollution to bypass the Parse Server `requestKeywordDenylist` option. This issue has been patched in versions 5.3.3 and 4.10.20. There are no known workarounds.
Parse Server es un backend de código abierto que se puede implementar en cualquier infraestructura que pueda ejecutar Node.js. En versiones anteriores a la 5.3.3 o 4.10.20, un endpoint de destino de Parse Server Cloud Code Webhook comprometido permite a un atacante utilizar contaminación de prototipo para omitir la opción `requestKeywordDenylist` de Parse Server. Este problema se solucionó en las versiones 5.3.3 y 4.10.20. No se conocen workarounds.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Parse Server. Authentication is required to exploit this vulnerability.
The specific flaw exists within the \_expandResultOnKeyPath function. The issue results from the lack of control over modifications to attributes of object prototypes. An attacker can leverage this vulnerability to execute code in the context of the service account.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-09-30 CVE Reserved
- 2022-11-10 CVE Published
- 2024-08-03 CVE Updated
- 2024-10-09 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CAPEC
References (1)
| URL | Tag | Source |
|---|---|---|
| https://github.com/parse-community/parse-server/security/advisories/GHSA-93vw-8fm5-p2jf | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Parseplatform Search vendor "Parseplatform" | Parse-server Search vendor "Parseplatform" for product "Parse-server" | < 4.10.20 Search vendor "Parseplatform" for product "Parse-server" and version " < 4.10.20" | node.js |
Affected
| ||||||
| Parseplatform Search vendor "Parseplatform" | Parse-server Search vendor "Parseplatform" for product "Parse-server" | >= 5.0.0 < 5.3.3 Search vendor "Parseplatform" for product "Parse-server" and version " >= 5.0.0 < 5.3.3" | node.js |
Affected
| ||||||