CVE-2023-36475
Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.
Parse Server es un backend de código abierto que puede desplegarse en cualquier infraestructura que pueda ejecutar Node.js. Antes de las versiones 5.5.2 y 6.2.1, un atacante puede utilizar un prototipo de "pollution sink" para desencadenar una ejecución remota de código a través del analizador BSON de MongoDB. Hay un parche disponible en las versiones 5.5.2 y 6.2.1.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Parse Server. Authentication is required to exploit this vulnerability.
The specific flaw exists within the transformUpdate function. The issue results from the lack of control over modifications to attributes of object prototypes. An attacker can leverage this vulnerability to execute code in the context of the service account.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-06-21 CVE Reserved
- 2023-06-28 CVE Published
- 2024-08-02 CVE Updated
- 2024-10-02 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| https://github.com/parse-community/parse-server/releases/tag/5.5.2 | Release Notes | |
| https://github.com/parse-community/parse-server/releases/tag/6.2.1 | Release Notes |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6 | 2023-07-06 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Parseplatform Search vendor "Parseplatform" | Parse-server Search vendor "Parseplatform" for product "Parse-server" | < 5.5.2 Search vendor "Parseplatform" for product "Parse-server" and version " < 5.5.2" | node.js |
Affected
| ||||||
| Parseplatform Search vendor "Parseplatform" | Parse-server Search vendor "Parseplatform" for product "Parse-server" | >= 6.0.0 < 6.2.1 Search vendor "Parseplatform" for product "Parse-server" and version " >= 6.0.0 < 6.2.1" | node.js |
Affected
| ||||||