Vulnerability · Published Jul 1, 2024 · Assigned by GitHub_M

CVE-2024-39309ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability

Critical 9.8

In plain English

A critical-severity authentication bypass in parse-server from parse-community. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 20.2% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)20.2%top 2.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to detect SQL injection has been improved in versions 6.5.7 and 7.1.0. No known workarounds are available.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	parse-server	6.5.7	GHSA-c2hr-cqg6-8j6r
npm	parse-server	7.1.0	GHSA-c2hr-cqg6-8j6r

Affected products (as reported)

Vendor	Product	Versions
parse-community	parse-server	< 6.5.7>= 7.0.0, < 7.1.0

Weakness: CWE-288, CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r x_refsource_CONFIRM
https://github.com/parse-community/parse-server/pull/9167 x_refsource_MISC
https://github.com/parse-community/parse-server/pull/9168 x_refsource_MISC
https://github.com/parse-community/parse-server/commit/2edf1e4c0363af01e97a7fbc97694f851b7d1ff3 x_refsource_MISC
https://github.com/parse-community/parse-server/commit/f332d54577608c5ad927255e06d8c694e2e0ff5b x_refsource_MISC