Executive brief
Parse Server is a backend-as-a-service platform used to build and run cloud applications. A vulnerability in its Cloud Code Webhooks feature allows an attacker who has compromised or controls a webhook endpoint to use prototype pollution to bypass the server's security protections (the requestKeywordDenylist), potentially gaining unauthorized access to restricted functionality or data.
Technical details
Parse Server is vulnerable to prototype pollution via Cloud Code Webhooks, which allows an attacker to bypass the requestKeywordDenylist security control. The vulnerability exists in how Parse Server processes webhook responses from Cloud Code Webhook target endpoints; a compromised endpoint can inject specially crafted payloads that pollute the JavaScript prototype chain. The attack requires the attacker to have control over or compromise the webhook target endpoint (high privilege requirement) and does not require user interaction. Successful exploitation bypasses keyword filtering protections and allows the attacker to access or manipulate restricted functionality. Patches are available in versions 4.10.20 and 5.3.3 or later, with improved keyword detection mechanisms.
Affected products
- Parse Community Parse Server <4.10.20, >=5.0.0 <5.3.3
Timeline
- 2022-11-10: disclosed
- 2022-11-10: patched: Versions 4.10.20 and 5.3.3 released with fix