CVE-2022-41878: Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers
First published: Wed Nov 09 2022(Updated: )
### Impact Keywords that are specified in the Parse Server option `requestKeywordDenylist` can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the `requestKeywordDenylist` option. ### Patches Improved keyword detection. ### Workarounds Configure your firewall to only allow trusted servers to make request to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature. ### Collaborators Mikhail Shcherbakov, Cristian-Alexandru Staicu and Musard Balliu working with Trend Micro Zero Day Initiative ### References - https://github.com/parse-community/parse-server/security/advisories/GHSA-xprv-wvh7-qqqx
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Parseplatform Parse-server | <4.10.19 | |
| Parseplatform Parse-server | >=5.0.0<5.3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/parse-community/parse-server/security/advisories/GHSA-xprv-wvh7-qqqx
- https://github.com/parse-community/parse-server/pull/8301
- https://github.com/parse-community/parse-server/pull/8302
- https://github.com/parse-community/parse-server/commit/0a2d412e265992d53a670011afd9d2578562adc3
- https://github.com/parse-community/parse-server/commit/6728da1e3591db1e27031d335d64d8f25546a06f
- https://nvd.nist.gov/vuln/detail/CVE-2022-41878
- https://github.com/advisories/GHSA-xprv-wvh7-qqqx (Advisory)
Frequently Asked Questions
What is CVE-2022-41878?
CVE-2022-41878 is a vulnerability in Parse Server that allows injection of keywords via Cloud Code Webhooks or Triggers, bypassing keyword denylisting.
What is the impact of CVE-2022-41878?
The impact of CVE-2022-41878 is that injected keywords can be saved to the database, bypassing the keyword denylisting mechanism.
How can I patch CVE-2022-41878?
You can patch CVE-2022-41878 by updating Parse Server to version 5.3.2 or applying the improved keyword detection patch.
What is the severity of CVE-2022-41878?
CVE-2022-41878 has a severity rating of 9.8 (Critical).
Where can I find more information about CVE-2022-41878?
You can find more information about CVE-2022-41878 in the links provided: [GitHub Advisory](https://github.com/parse-community/parse-server/security/advisories/GHSA-xprv-wvh7-qqqx), [Pull Request 8301](https://github.com/parse-community/parse-server/pull/8301), [Pull Request 8302](https://github.com/parse-community/parse-server/pull/8302).
- collector/github-advisory-latest
- alias/GHSA-xprv-wvh7-qqqx
- alias/CVE-2022-41878
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/author
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/title
- agent/references
- agent/description
- agent/event
- agent/tags
- agent/trending
- package-manager/npm
- vendor/parseplatform
- canonical/parseplatform parse-server
- version/parseplatform parse-server/5.0.0