CVE-2024-27298: Parse Server literalizeRegexPart SQL Injection
Impact
This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database.
Patches
The algorithm to detect SQL injection has been improved.
Workarounds
None.
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2 - https://github.com/parse-community/parse-server/releases/tag/6.5.0 (fixed in Parse Server 6) - https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20 (fixed in Parse Server 7 alpha release)
Credits
- Mikhail Shcherbakov (https://twitter.com/yu5k3) working with Trend Micro Zero Day Initiative (finder) - Ehsan Persania (remediation developer) - Manuel Trezza (coordinator)
Other sources
parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27298?
CVE-2024-27298 is classified as a SQL injection vulnerability that can have significant impact if exploited.
How do I fix CVE-2024-27298?
To fix CVE-2024-27298, update to the patched version of Parse Server which is 7.0.0-alpha.20 or later.
Who is affected by CVE-2024-27298?
CVE-2024-27298 affects users of Parse Server versions prior to 7.0.0-alpha.20 and 6.5.0.
What type of vulnerability is CVE-2024-27298?
CVE-2024-27298 is a SQL injection vulnerability when Parse Server is configured to use PostgreSQL.
Are there any workarounds for CVE-2024-27298?
There are currently no workarounds available for CVE-2024-27298, so updating the software is the recommended action.