CVE-2022-24760 : Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RC

Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file `DatabaseController.js`, so it is likely to affect Postgres and any other database backend as well. This vulnerability has been confirmed on Linux (Ubuntu) and Windows. Users are advised to upgrade as soon as possible. The only known workaround is to manually patch your installation with code referenced at the source GHSA-p6h4-93qp-jhcm.

Published 2022-03-12 00:15:09

Updated 2022-07-01 16:06:50

Source GitHub, Inc.

View at NVD, CVE.org

Vulnerability category: Execute code

Exploit prediction scoring system (EPSS) score for CVE-2022-24760

EPSS FAQ

8.41%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 95 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-24760

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
10.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	3.9	6.0	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High
10.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	3.9	6.0	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-24760

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Assigned by: security-advisories@github.com (Secondary)

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-24760

https://github.com/parse-community/parse-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d

fix: security vulnerability that allows remote code execution (ghsa p… · parse-community/parse-server@886bfd7 · GitHub
Patch;Third Party Advisory
https://www.huntr.dev/bounties/ac24b343-e7da-4bc7-ab38-4f4f5cc9d099/

Command Injection vulnerability found in parse-server
Exploit;Patch;Third Party Advisory
https://github.com/parse-community/parse-server/security/advisories/GHSA-p6h4-93qp-jhcm

Command injection via prototype pollution · Advisory · parse-community/parse-server · GitHub
Exploit;Mitigation;Third Party Advisory

Products affected by CVE-2022-24760

Parseplatform » Parse-server » For Node.js
Versions before (<) 4.10.7
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
Matching versions
When used together with: Canonical » Ubuntu Linux » Version: N/A
When used together with: Microsoft » Windows » Version: N/A

Vulnerability Details : CVE-2022-24760

Exploit prediction scoring system (EPSS) score for CVE-2022-24760

CVSS scores for CVE-2022-24760

CWE ids for CVE-2022-24760

References for CVE-2022-24760

Products affected by CVE-2022-24760