PT-2023-25584 · Unknown+2 · Parse Server+2

Hir0Ot · Publicado 2023-06-28 · Atualizado 2024-03-06 · CVE-2023-36475

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 5.5.2 and 6.2.1

Description The issue allows an attacker to use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. This can be exploited in Parse Server, an open source backend that can be deployed to any infrastructure that can run Node.js.

Recommendations For versions prior to 5.5.2, update to version 5.5.2 to resolve the issue. For versions prior to 6.2.1, update to version 6.2.1 to resolve the issue. As a temporary workaround, consider disabling remote code execution through the MongoDB BSON parser until a patch is available.

Exploit

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

BIT-PARSE-2023-36475

CVE-2023-36475

GHSA-462X-C3JW-7VR6

ZDI-23-1160

Produtos afetados

Mongodb

Node.Js

Parse Server

Referências · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36475.json · Exploit
• https://github.com/parse-community/parse-server · Nota
• https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6 · Aviso do Fabricante
• https://github.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b42844180546d90c7aa90 · Correção
• https://github.com/parse-community/parse-server/issues/8674 · Correção
• https://github.com/parse-community/parse-server/issues/8675 · Correção
• https://github.com/parse-community/parse-server/commit/5fad2928fb8ee17304abcdcf259932f827d8c81f · Correção
• https://github.com/parse-community/parse-server/releases/tag/6.2.1 · Nota
• https://github.com/parse-community/parse-server/releases/tag/5.5.2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-36475 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-36475 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-parse-2023-36475 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-462x-c3jw-7vr6 · Aviso do Fabricante
• https://t.me/cvenotify/53256 · Publicação no Telegram
• https://zerodayinitiative.com/advisories/ZDI-23-1160 · Nota de Segurança