PT-2023-23963 · Unknown · Parse-Server-Push-Adapter

Mtrezza · Published 2023-05-22 · Updated 2023-06-02 · CVE-2023-32688

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions parse-server-push-adapter versions prior to 4.1.3

Description The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload.

Recommendations For versions prior to 4.1.3, update to version 4.1.3 to resolve the issue. As a temporary workaround, consider implementing input validation to prevent invalid push notification payloads from crashing the server.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-32688

GHSA-MXHG-RVWX-X993

Affected Products

Parse-Server-Push-Adapter

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32688.json · Exploit
• https://github.com/parse-community/parse-server-push-adapter/pull/217 · Patch
• https://github.com/parse-community/parse-server-push-adapter/security/advisories/GHSA-mxhg-rvwx-x993 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-32688 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mxhg-rvwx-x993 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32688 · Security Note
• https://github.com/parse-community/parse-server-push-adapter/releases/tag/4.1.3 · Note
• https://github.com/parse-community/parse-server-push-adapter/commit/598cb84d0866b7c5850ca96af920e8cb5ba243ec · Note
• https://github.com/parse-community/parse-server-push-adapter · Note
• https://t.me/cvenotify/51646 · Telegram Post
• https://t.me/cibsecurity/64737 · Telegram Post