GHSA-fcv6-fg5r-jm9q BIT-parse-2023-41058 CVE-2023-41058
Trigger `beforeFind` not invoked in internal query pipeline when fetching pointer
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.77%
- Chance of exploitation in the next 30 days. Higher than 55.59% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-670 Always-Incorrect Control Flow Implementation
- Fix
5.5.5- Upgrade parse-server to this version or later
Description
Impact
A Parse Pointer can be used to access internal Parse Server classes. It can also be used to circumvent the beforeFind query trigger which can be an additional vulnerability for deployments where the beforeFind trigger is used as a security layer to modify an incoming query.
Patches
The vulnerability was fixed by implementing a patch in the internal query pipeline to prevent a Parse Pointer to be used to access internal Parse Server classes or circumvent the beforeFind trigger.
Workarounds
There is no known workaround to prevent a Parse Pointer to be used to access internal Parse Server classes. A workaround if a beforeFind trigger is used as a security layer is to instead use the Parse Server provided security layers to manage access levels with Class-Level Permissions and Object-Level Access Control.
References
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-fcv6-fg5r-jm9q
- Patched in Parse Server 6.x: https://github.com/parse-community/parse-server/releases/tag/6.2.2
- Patched in Parse Server 5.x (LTS): https://github.com/parse-community/parse-server/releases/tag/5.5.5
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| parse-server | >= 1.0.0, < 5.5.5 |
5.5.5 |
| parse-server | >= 6.0.0, < 6.2.2 |
6.2.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
parse-server npm → 5.5.5
- npm
npm install parse-server@5.5.5- yarn
yarn add parse-server@5.5.5- pnpm
pnpm add parse-server@5.5.5
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-670: Always-Incorrect Control Flow Implementation
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
References
Advisories
Packages
Other links
- github.com/parse-community/parse-server/security/advisories/GHSA-fcv6-fg5r-jm9q
- github.com/parse-community/parse-server/commit/be4c7e23c63a2fb690685665cebed0de…
- docs.parseplatform.org/parse-server/guide
- github.com/parse-community/parse-server/releases/tag/5.5.5
- github.com/parse-community/parse-server/releases/tag/6.2.2
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-r899-h629-j84r Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist | Low | Also affects parse-server |
| GHSA-97pr-9hgg-3p8r parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change | Low | Also affects parse-server |
| GHSA-v8x7-r927-cc93 parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist | Low | Also affects parse-server |
| GHSA-cgxm-vr2f-6fj8 parse-server: Denial of service via exponential-time processing of deeply nested query operators | High | Also affects parse-server |
| GHSA-wmwx-jr2p-4j4r parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL | Medium | Also affects parse-server |
| GHSA-75v4-m273-5j49 parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied | Medium | Also affects parse-server |
| GHSA-7wqv-xjf3-x35v parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist | Low | Also affects parse-server |
| GHSA-p84r-h6rx-f2xr parse-server: Server option routeAllowList is bypassable through batch sub-requests | Medium | Also affects parse-server |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor