Executive brief
Parse Server is a backend-as-a-service platform that many applications rely on for data management and business logic execution. This vulnerability allows attackers with high privileges to inject prohibited keywords through Cloud Code Webhooks or Triggers, bypassing security restrictions and potentially corrupting the application's database or gaining unauthorized data access. Organizations using Parse Server with restrictive keyword policies should treat this as a high-priority issue.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in Parse Server's Cloud Code Webhooks and Triggers handling. The vulnerability allows keywords specified in the requestKeywordDenylist configuration to be injected and saved to the database, effectively circumventing the keyword filtering mechanism. The attack requires high privileges (a trusted or compromised Cloud Code endpoint) and network access to the Parse Server API. An attacker can exploit this to bypass security policies, inject malicious data, or manipulate server state. Patches are available in versions 4.10.19 and 5.3.2 or later with improved keyword detection.
Affected products
- Parse Community Parse Server before 4.10.19, and 5.0.0 before 5.3.2
Timeline
- 2022-11-09: disclosed: Advisory published
- 2022-11-09: patched: Patches available in 4.10.19 and 5.3.2+