PT-2022-26110 · Unknown · Parse Server

Cristian-Alexandru Staicu + 2 · Published 2022-11-09 · Updated 2026-03-10 · CVE-2022-41878

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 4.10.19 Parse Server versions prior to 5.3.2

Description The issue allows keywords specified in the requestKeywordDenylist option to be injected via Cloud Code Webhooks or Triggers, resulting in the keyword being saved to the database and bypassing the requestKeywordDenylist option. This can be exploited by making requests to the Cloud Code Webhooks API. To mitigate this, configuring the firewall to only allow trusted servers to make requests to the Parse Server Cloud Code Webhooks API or blocking the API completely if not in use can help.

Recommendations For versions prior to 4.10.19, update to version 4.10.19 or later. For versions prior to 5.3.2, update to version 5.3.2 or later. As a temporary workaround, consider configuring your firewall to only allow trusted servers to make requests to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature.

Exploit

Fix

Special Elements Injection

Prototype Pollution

Weakness Enumeration

CWE-74

CWE-1321

Related Identifiers

BIT-PARSE-2022-41878

CVE-2022-41878

GHSA-XPRV-WVH7-QQQX

ZDI-22-1591

Affected Products

Parse Server

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41878.json · Exploit
• https://osv.dev/vulnerability/GHSA-xprv-wvh7-qqqx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41878 · Security Note
• https://osv.dev/vulnerability/BIT-parse-2022-41878 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1591 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41878 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/commit/6728da1e3591db1e27031d335d64d8f25546a06f · Note
• https://github.com/parse-community/parse-server/pull/8302 · Note
• https://github.com/parse-community/parse-server/security/advisories/GHSA-xprv-wvh7-qqqx · Note
• https://github.com/parse-community/parse-server/commit/0a2d412e265992d53a670011afd9d2578562adc3 · Note
• https://github.com/parse-community/parse-server/pull/8301 · Note
• https://twitter.com/dailycve/status/2031216347149943057 · Twitter Post