Vulnerability · Published Sep 7, 2022 · Assigned by GitHub_M

CVE-2022-36079Parse Server vulnerable to brute force guessing of user sensitive data via search patterns

High 8.6

In plain English

A high-severity information exposure in parse-server from parse-community. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)1.3%top 29.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Internal fields (keys used internally by Parse Server, prefixed by `_`) and protected fields (user defined) can be used as query constraints. Internal and protected fields are removed by Parse Server and are only returned to the client using a valid master key. However, using query constraints, these fields can be guessed by enumerating until Parse Server, prior to versions 4.10.14 or 5.2.5, returns a response object. The patch available in versions 4.10.14 and 5.2.5 requires the maser key to use internal and protected fields as query constraints. As a workaround, implement a Parse Cloud Trigger `beforeFind` and manually remove the query constraints.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	parse-server	4.10.14	GHSA-2m6g-crv8-p3c6
npm	parse-server	5.2.5	GHSA-2m6g-crv8-p3c6

Affected products (as reported)

Vendor	Product	Versions
parse-community	parse-server	< 4.10.14>= 5.0.0, < 5.2.5

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/parse-community/parse-server/security/advisories/GHSA-2m6g-crv8-p3c6 x_refsource_CONFIRM
https://github.com/parse-community/parse-server/issues/8143 x_refsource_MISC
https://github.com/parse-community/parse-server/issues/8144 x_refsource_MISC
https://github.com/parse-community/parse-server/commit/634c44acd18f6ee6ec60fac89a2b602d92799bec x_refsource_MISC
https://github.com/parse-community/parse-server/commit/e39d51bd329cd978589983bd659db46e1d45aad4 x_refsource_MISC
https://github.com/parse-community/parse-server/releases/tag/4.10.14 x_refsource_MISC
https://github.com/parse-community/parse-server/releases/tag/5.2.5 x_refsource_MISC