CVE-2022-39396: Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser
Impact
An attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser.
Patches
Prevent prototype pollution in MongoDB database adapter.
Workarounds
Disable remote code execution through the MongoDB BSON parser.
Collaborators
Mikhail Shcherbakov (KTH), Cristian-Alexandru Staicu (CISPA) and Musard Balliu (KTH) working with Trend Micro Zero Day Initiative
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-prm5-8g2m-24gg
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.18, and prior to 5.3.1 on the 5.X branch, are vulnerable to Remote Code Execution via prototype pollution. An attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. This issue is patched in version 5.3.1 and in 4.10.18. There are no known workarounds.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-39396?
CVE-2022-39396 is a vulnerability that allows an attacker to trigger a remote code execution through the MongoDB BSON parser in Parse Server, an open-source backend.
What is the impact of CVE-2022-39396?
The impact of CVE-2022-39396 is that an attacker can use this vulnerability to execute remote code on the affected system.
How can I patch the vulnerability CVE-2022-39396?
To patch the vulnerability CVE-2022-39396, you need to prevent prototype pollution in the MongoDB database adapter used by Parse Server.
Are there any workarounds for CVE-2022-39396?
Yes, you can disable remote code execution through the MongoDB BSON parser as a workaround for CVE-2022-39396.
Where can I find more information about CVE-2022-39396?
You can find more information about CVE-2022-39396 in the following references: [link 1](https://github.com/parse-community/parse-server/security/advisories/GHSA-prm5-8g2m-24gg), [link 2](https://github.com/parse-community/parse-server/pull/8295), [link 3](https://github.com/parse-community/parse-server/pull/8296).