CVE-2024-47183: Parse Server's custom object ID allows to acquire role privileges
Impact
If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role.
Patches
Improved validation for custom user object IDs. Session tokens for existing users with an object ID that exploits the vulnerability are now rejected.
Workarounds
- Disable custom object IDs by setting allowCustomObjectId: false or not setting the option which defaults to false. - Use a Cloud Code Trigger to validate that a new user's object ID doesn't start with the prefix role:.
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg - https://github.com/parse-community/parse-server/pull/9317 (fix for Parse Server 7) - https://github.com/parse-community/parse-server/pull/9318 (fix for Parse Server 6)
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47183?
CVE-2024-47183 is a critical vulnerability that allows unauthorized privilege escalation if the `allowCustomObjectId` option is enabled.
How do I fix CVE-2024-47183?
To fix CVE-2024-47183, update your Parse Server to version 7.3.0 or 6.5.9, ensuring proper validation is enforced.
What systems are affected by CVE-2024-47183?
CVE-2024-47183 affects Parse Server versions between 7.0.0 and 7.3.0, as well as all versions up to 6.5.9.
What exploit method is used in CVE-2024-47183?
In CVE-2024-47183, an attacker can exploit the vulnerability by creating a new user with a custom object ID to gain undue privileges.
What should I do if I'm running an affected version of Parse Server for CVE-2024-47183?
If running an affected version of Parse Server, it is crucial to upgrade to a patched version immediately to mitigate the risk of exploitation.