Vulnerability · Published Nov 10, 2022 · Assigned by GitHub_M
CVE-2022-41878Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers
High 7.2
In plain English
A high-severity injection in parse-server from parse-community. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that are specified in the Parse Server option `requestKeywordDenylist` can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the `requestKeywordDenylist` option. This issue is fixed in versions 4.10.19, and 5.3.2. If upgrade is not possible, the following Workarounds may be applied: Configure your firewall to only allow trusted servers to make request to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | parse-server | 4.10.19 | GHSA-xprv-wvh7-qqqx |
| npm | parse-server | 5.3.2 | GHSA-xprv-wvh7-qqqx |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| parse-community | parse-server | < 4.10.19 |
Weakness: CWE-74, CWE-1321 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H