Executive brief
Parse Server is a popular backend-as-a-service framework used to power mobile and web applications. A critical flaw in its database handling code allows unauthenticated remote attackers to execute arbitrary code on the server, potentially compromising all stored data, application functionality, and the underlying infrastructure.
Technical details
This is a remote code execution vulnerability stemming from prototype pollution in Parse Server's DatabaseController.js file. The vulnerability occurs when untrusted user input is deserialized without proper sanitization, allowing attackers to pollute JavaScript prototype chains through BSON deserialization. An attacker can inject malicious code properties that are executed during server processing, leading to arbitrary command execution. The vulnerability affects all versions prior to 4.10.7 and requires no authentication or user interaction. The fix involves validating and blocking dangerous keywords like "constructor", "__proto__", and BSON code types in request payloads.
Affected products
- Parse Community Parse Server all versions prior to 4.10.7
Timeline
- 2022-03-11: disclosed
- 2022-03-11: patched: Fixed in version 4.10.7