PT-2022-20537 · Unknown · Parse Server

Mtrezza · Published 2022-06-30 · Updated 2024-03-06 · CVE-2022-31112

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Parse Server (affected versions not specified)

Description The issue concerns Parse Server LiveQuery, which in affected versions does not remove protected fields in classes, passing them to the client. This has been addressed by the LiveQueryController, which now removes protected fields from the client response. Users are advised to upgrade to resolve the issue. For those unable to upgrade, using Parse.Cloud.afterLiveQueryEvent to manually remove protected fields is recommended as a workaround.

Recommendations To resolve the issue, users should upgrade to a version where the LiveQueryController removes protected fields from the client response. As a temporary workaround, consider using Parse.Cloud.afterLiveQueryEvent to manually remove protected fields until a patch is applied.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-212

CWE-200

Related Identifiers

BIT-PARSE-2022-31112

CVE-2022-31112

GHSA-CRRQ-VR9J-FXXH

Affected Products

Parse Server

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31112.json · Exploit
• https://github.com/parse-community/parse-server/commit/309f64ced8700321df056fb3cc97f15007a00df1 · Patch
• https://github.com/parse-community/parse-server/issues/8073 · Patch
• https://github.com/parse-community/parse-server/pull/8074 · Patch
• https://github.com/parse-community/parse-server/commit/9fd4516cde5c742f9f29dd05468b4a43a85639a6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31112 · Security Note
• https://osv.dev/vulnerability/BIT-parse-2022-31112 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31112 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-crrq-vr9j-fxxh · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/5.2.4 · Note
• https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh · Note
• https://github.com/parse-community/parse-server/commit/054f3e6ab01d66a0dcfb77725af28eac1485b375 · Note
• https://t.me/cibsecurity/45418 · Telegram Post
• https://t.me/cvenotify/32898 · Telegram Post