PT-2022-24955 · Unknown+2 · Parse Server+2

Cristian-Alexandru Staicu + 2 · Published 2022-11-08 · Updated 2024-03-06 · CVE-2022-39396

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 4.10.18 Parse Server versions prior to 5.3.1 on the 5.X branch

Description Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. An attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. This issue is patched in version 5.3.1 and in 4.10.18.

Recommendations For versions prior to 4.10.18, update to version 4.10.18 or later. For versions prior to 5.3.1 on the 5.X branch, update to version 5.3.1 or later. As a temporary workaround, consider disabling remote code execution through the MongoDB BSON parser until a patch is available.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

BIT-PARSE-2022-39396

CVE-2022-39396

GHSA-PRM5-8G2M-24GG

ZDI-22-1590

Affected Products

Mongodb

Node.Js

Parse Server

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39396.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-39396 · Security Note
• https://osv.dev/vulnerability/GHSA-prm5-8g2m-24gg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39396 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2022-39396 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1590 · Security Note
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/pull/8296 · Note
• https://github.com/parse-community/parse-server/releases/tag/5.3.1 · Note
• https://github.com/parse-community/parse-server/security/advisories/GHSA-prm5-8g2m-24gg · Note
• https://github.com/parse-community/parse-server/releases/tag/4.10.18 · Note
• https://github.com/parse-community/parse-server/pull/8295 · Note
• https://t.me/cibsecurity/52927 · Telegram Post
• https://t.me/cybersecuritytechnologies/8053 · Telegram Post
• https://t.me/cvenotify/37480 · Telegram Post