PT-2024-32465 · Unknown · Parse Server

Kartal Kaan Bozdoğan + 1 · Published 2024-10-04 · Updated 2026-02-25 · CVE-2024-47183

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 6.5.9 Parse Server versions prior to 7.3.0

Description The issue arises when the Parse Server option allowCustomObjectId: true is set, allowing an attacker to create a new user with a custom object ID that exploits the vulnerability and acquires privileges of a specific role.

Recommendations For versions prior to 6.5.9, update to version 6.5.9 or later to resolve the issue. For versions prior to 7.3.0, update to version 7.3.0 or later to resolve the issue. As a temporary workaround, consider disabling custom object IDs by setting allowCustomObjectId: false. Alternatively, use a Cloud Code Trigger to validate that a new user's object ID doesn't start with the prefix role:.

Exploit

Fix

Improper Authorization

Incorrect Authorization

Weakness Enumeration

CWE-285

CWE-863

Related Identifiers

BIT-PARSE-2024-47183

CVE-2024-47183

GHSA-8XQ9-G7CH-35HG

Affected Products

Parse Server

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47183.json · Exploit
• https://github.com/parse-community/parse-server/pull/9317 · Patch
• https://github.com/parse-community/parse-server/commit/1bfbccf9ee7ea77533b2b2aa7c4c69f3bd35e66f · Patch
• https://github.com/parse-community/parse-server/pull/9318 · Patch
• https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc · Patch
• https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47183 · Security Note
• https://osv.dev/vulnerability/GHSA-8xq9-g7ch-35hg · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2024-47183 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47183 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://twitter.com/CVEnew/status/1842228105949204642 · Twitter Post
• https://t.me/cvedetector/6989 · Telegram Post
• https://twitter.com/cracbot/status/1843894217086800136 · Twitter Post
• https://t.me/cveNotify/153191 · Telegram Post