CVE-2022-41878: Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers
Impact
Keywords that are specified in the Parse Server option requestKeywordDenylist can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the requestKeywordDenylist option.
Patches
Improved keyword detection.
Workarounds
Configure your firewall to only allow trusted servers to make request to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature.
Collaborators
Mikhail Shcherbakov, Cristian-Alexandru Staicu and Musard Balliu working with Trend Micro Zero Day Initiative
References - https://github.com/parse-community/parse-server/security/advisories/GHSA-xprv-wvh7-qqqx
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that are specified in the Parse Server option requestKeywordDenylist can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the requestKeywordDenylist option. This issue is fixed in versions 4.10.19, and 5.3.2. If upgrade is not possible, the following Workarounds may be applied: Configure your firewall to only allow trusted servers to make request to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/parse-serverto a version that resolves this vulnerability.Fixed in 5.3.2 - Upgrade
Upgrade
npm/parse-serverto a version that resolves this vulnerability.Fixed in 4.10.19 - Upgrade
Upgrade
parse-serverto a version that resolves this vulnerability.Fixed in 4.10.19 - Upgrade
Upgrade
parse-serverto a version that resolves this vulnerability.Fixed in 5.3.2 - Configuration
Ensure Parse Server is configured with the Cloud Code Webhooks/Triggers keyword denylist option `requestKeywordDenylist` (note: in versions prior to 5.3.2 or 4.10.19 this can be bypassed via injection through Cloud Code Webhooks or Cloud Code Triggers).
Parse Server requestKeywordDenylist = Not specified - Compensating control
Configure your firewall to only allow trusted servers to make requests to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature.
Event History
Frequently Asked Questions
What is CVE-2022-41878?
CVE-2022-41878 is a vulnerability in Parse Server that allows injection of keywords via Cloud Code Webhooks or Triggers, bypassing keyword denylisting.
What is the impact of CVE-2022-41878?
The impact of CVE-2022-41878 is that injected keywords can be saved to the database, bypassing the keyword denylisting mechanism.
How can I patch CVE-2022-41878?
You can patch CVE-2022-41878 by updating Parse Server to version 5.3.2 or applying the improved keyword detection patch.
What is the severity of CVE-2022-41878?
CVE-2022-41878 has a severity rating of 9.8 (Critical).
Where can I find more information about CVE-2022-41878?
You can find more information about CVE-2022-41878 in the links provided: [GitHub Advisory](https://github.com/parse-community/parse-server/security/advisories/GHSA-xprv-wvh7-qqqx), [Pull Request 8301](https://github.com/parse-community/parse-server/pull/8301), [Pull Request 8302](https://github.com/parse-community/parse-server/pull/8302).