PT-2022-23167 · Unknown · Parse Server

Mtrezza + 1 · Published 2022-09-07 · Updated 2024-03-06 · CVE-2022-36079

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 4.10.14 Parse Server versions prior to 5.2.5

Description Internal fields (keys used internally by Parse Server, prefixed by ) and protected fields (user defined) can be used as query constraints. These fields are removed by Parse Server and are only returned to the client using a valid master key. However, using query constraints, these fields can be guessed by enumerating until Parse Server returns a response object. The issue can be exploited by using the query. where object to guess internal and protected fields.

Recommendations For versions prior to 4.10.14, update to version 4.10.14 or later. For versions prior to 5.2.5, update to version 5.2.5 or later. As a temporary workaround, implement a Parse Cloud Trigger beforeFind and manually remove the query constraints, such as deleting keys that start with from the query. where object.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-PARSE-2022-36079

CVE-2022-36079

GHSA-2M6G-CRV8-P3C6

Affected Products

Parse Server

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36079.json · Exploit
• https://github.com/parse-community/parse-server/commit/e39d51bd329cd978589983bd659db46e1d45aad4 · Patch
• https://github.com/parse-community/parse-server/commit/634c44acd18f6ee6ec60fac89a2b602d92799bec · Patch
• https://osv.dev/vulnerability/CVE-2022-36079 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36079 · Security Note
• https://osv.dev/vulnerability/BIT-parse-2022-36079 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2m6g-crv8-p3c6 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/issues/8144 · Note
• https://github.com/parse-community/parse-server/releases/tag/5.2.5 · Note
• https://github.com/parse-community/parse-server/releases/tag/4.10.14 · Note
• https://github.com/parse-community/parse-server/issues/8143 · Note
• https://github.com/parse-community/parse-server/security/advisories/GHSA-2m6g-crv8-p3c6 · Note
• https://t.me/cibsecurity/49407 · Telegram Post