PT-2021-22444 · Unknown · Parse Server+1

Kartal Kaan Bozdoğan · Published 2021-09-02 · Updated 2024-03-06 · CVE-2021-39187

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 4.10.3

Description The issue occurs when a query request contains an invalid value for the explain option, causing Parse Server to crash due to a bug in the MongoDB Node.js driver that throws an exception Parse Server cannot catch.

Recommendations For versions prior to 4.10.3, upgrade to Parse Server 4.10.3 to resolve the issue. As a temporary workaround, consider avoiding the use of the explain option in query requests until the patch is applied.

Fix

Improper Handling of Exceptional Conditions

RCE

Special Elements Injection

Weakness Enumeration

CWE-755

CWE-20

CWE-74

Related Identifiers

BIT-PARSE-2021-39187

CVE-2021-39187

GHSA-XQP8-W826-HH6X

Affected Products

Mongodb Node.Js Driver

Parse Server

References · 10

• https://github.com/parse-community/parse-server/commit/308668c89474223e2448be92d6823b52c1c313ec · Patch
• https://osv.dev/vulnerability/GHSA-xqp8-w826-hh6x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39187 · Security Note
• https://osv.dev/vulnerability/BIT-parse-2021-39187 · Vendor Advisory
• https://jira.mongodb.org/browse/NODE-3463 · Patch
• https://osv.dev/vulnerability/CVE-2021-39187 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/4.10.3 · Note
• https://github.com/parse-community/parse-server/security/advisories/GHSA-xqp8-w826-hh6x · Note
• https://t.me/cvenotify/34302 · Telegram Post