PT-2023-25584 · Unknown+2 · Parse Server+2

Hir0Ot · Published 2023-06-28 · Updated 2024-03-06 · CVE-2023-36475

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 5.5.2 and 6.2.1

Description The issue allows an attacker to use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. This can be exploited in Parse Server, an open source backend that can be deployed to any infrastructure that can run Node.js.

Recommendations For versions prior to 5.5.2, update to version 5.5.2 to resolve the issue. For versions prior to 6.2.1, update to version 6.2.1 to resolve the issue. As a temporary workaround, consider disabling remote code execution through the MongoDB BSON parser until a patch is available.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

BIT-PARSE-2023-36475

CVE-2023-36475

GHSA-462X-C3JW-7VR6

ZDI-23-1160

Affected Products

Mongodb

Node.Js

Parse Server

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36475.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6 · Vendor Advisory
• https://github.com/parse-community/parse-server/issues/8675 · Patch
• https://github.com/parse-community/parse-server/issues/8674 · Patch
• https://github.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b42844180546d90c7aa90 · Patch
• https://github.com/parse-community/parse-server/commit/5fad2928fb8ee17304abcdcf259932f827d8c81f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-36475 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-1160 · Security Note
• https://osv.dev/vulnerability/GHSA-462x-c3jw-7vr6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-36475 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2023-36475 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/6.2.1 · Note
• https://github.com/parse-community/parse-server/releases/tag/5.5.2 · Note
• https://t.me/cvenotify/53256 · Telegram Post