PT-2022-16862 · Canonical+1 · Ubuntu+1

Mtrezzap · Published 2022-03-11 · Updated 2024-03-06 · CVE-2022-24760

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 4.10.7

Description The issue is a Remote Code Execution (RCE) vulnerability in Parse Server, affecting the default configuration with MongoDB. The main weakness is the Prototype Pollution vulnerable code in the file DatabaseController.js, which may also affect Postgres and other database backends. This vulnerability has been confirmed on Linux (Ubuntu) and Windows.

Recommendations Upgrade to Parse Server >=4.10.7. If you are using a prerelease version of Parse Server 5.0 (alpha, beta), wait for a timely fix. As a temporary workaround, consider patching the MongoDB Node.js driver and disabling BSON code execution by adding the provided code to be executed before starting Parse Server. To prevent JavaScript prototype pollution, a new security feature scans for sensitive keywords in request data, and you can override the default keywords by setting the new Parse Server option requestKeywordDenylist to [] and specifying your own keywords as needed.

Exploit

Fix

Special Elements Injection

Prototype Pollution

Weakness Enumeration

CWE-74

CWE-1321

Related Identifiers

BIT-PARSE-2022-24760

CVE-2022-24760

GHSA-P6H4-93QP-JHCM

Affected Products

Ubuntu

Windows

References · 10

• 🔥 https://github.com/parse-community/parse-server/security/advisories/GHSA-p6h4-93qp-jhcm · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24760.json · Exploit
• 🔥 https://huntr.dev/bounties/ac24b343-e7da-4bc7-ab38-4f4f5cc9d099 · Exploit
• https://github.com/parse-community/parse-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24760 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24760 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p6h4-93qp-jhcm · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2022-24760 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://t.me/cvenotify/29069 · Telegram Post