PT-2022-24827 · Unknown · Parse Server

Mtrezza · Published 2022-09-21 · Updated 2024-03-06 · CVE-2022-39231

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 4.10.16 Parse Server versions 5.0.0 through 5.2.6

Description The issue concerns the validation of the authentication adapter app ID for Facebook and Spotify. In affected configurations, where the appIds is set as a string instead of an array of strings, an attacker can authenticate requests from an app with a different app ID than the one specified in the appIds configuration. This can happen if the attacker is assigned an app ID by the authentication provider that is a subset of the server-side configured app ID. Both Facebook and Spotify adapters still validate the access token with the respective authentication provider.

Recommendations For Parse Server versions prior to 4.10.16, update to version 4.10.16 or later. For Parse Server versions 5.0.0 through 5.2.6, update to version 5.2.7 or later. As a temporary workaround, consider setting appIds as an array of strings instead of a string to prevent exploitation. Restrict access to the authentication adapter for Facebook and Spotify to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BIT-PARSE-2022-39231

CVE-2022-39231

GHSA-R657-33VP-GP22

Affected Products

Parse Server

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39231.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-39231 · Security Note
• https://osv.dev/vulnerability/GHSA-r657-33vp-gp22 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2022-39231 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39231 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/commit/8c8ec715739e0f851338cfed794409ebac66c51b · Note
• https://github.com/parse-community/parse-server/releases/tag/4.10.16 · Note
• https://github.com/parse-community/parse-server/security/advisories/GHSA-r657-33vp-gp22 · Note
• https://github.com/parse-community/parse-server/releases/tag/5.2.7 · Note
• https://t.me/cibsecurity/50308 · Telegram Post