GHSA-xprv-wvh7-qqqx: Parse Server vulnerable to Prototype Pollution via Cloud Code Webhooks or Cloud Code Triggers

Package

npm parse-server (npm)

Affected versions

< 4.10.19

>= 5.0.0, < 5.3.2

Patched versions

4.10.19

5.3.2

Description

Impact

Keywords that are specified in the Parse Server option requestKeywordDenylist can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the requestKeywordDenylist option.

Patches

Improved keyword detection.

Workarounds

Configure your firewall to only allow trusted servers to make request to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature.

Collaborators

Mikhail Shcherbakov, Cristian-Alexandru Staicu and Musard Balliu working with Trend Micro Zero Day Initiative

References

• GHSA-xprv-wvh7-qqqx
• parse-community/parse-server#8301
• parse-community/parse-server#8302
• parse-community/parse-server@0a2d412
• parse-community/parse-server@6728da1

mtrezza published the maintainer security advisory

Nov 9, 2022

Severity

High

7.2

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-1321

CVE ID

CVE-2022-41878

GHSA ID

GHSA-xprv-wvh7-qqqx

Source code

parse-community/parse-server

Checking history

See something to contribute? Suggest improvements for this vulnerability.