CVE-2023-36475: Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
Impact
An attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser.
Patches
Prevent prototype pollution in MongoDB database adapter.
Workarounds
Disable remote code execution through the MongoDB BSON parser.
Credits
- Discovered by hir0ot working with Trend Micro Zero Day Initiative - Fixed by dbythy - Reviewed by mtrezza
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6 - https://github.com/advisories/GHSA-prm5-8g2m-24gg
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/parse-serverto a version that resolves this vulnerability.Fixed in 6.2.1 - Upgrade
Upgrade
npm/parse-serverto a version that resolves this vulnerability.Fixed in 5.5.2 - Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 5.5.2 - Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 6.2.1 - Compensating control
Disable remote code execution through the MongoDB BSON parser.
Event History
Frequently Asked Questions
What is the impact of CVE-2023-36475?
An attacker can use this vulnerability to trigger a remote code execution through the MongoDB BSON parser.
How can I fix CVE-2023-36475?
Apply the patch to prevent prototype pollution in the MongoDB database adapter.
Are there any workarounds to protect against CVE-2023-36475?
Disable remote code execution through the MongoDB BSON parser.
What is the severity of CVE-2023-36475?
The severity of this vulnerability is critical with a CVSS score of 9.8.
Where can I find more information about CVE-2023-36475?
You can find more information about CVE-2023-36475 at the following references: [GitHub Advisory](https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-36475), [GitHub Issue](https://github.com/parse-community/parse-server/issues/8674).