Command Injection in Parse server
60Vexday Risk Score
Keep watching. It has a public proof of concept.
ssvc Attendcvss 10epss 49%
from disclosure to weapon20 days
Published on NVDMar 11
1st PoC+20d
exploitation probability
49%top 1% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file `DatabaseController.js`, so it is likely to affect Postgres and any other database backend as well. This vulnerability has been confirmed on Linux (Ubuntu) and Windows. Users are advised to upgrade as soon as possible. The only known workaround is to manually patch your installation with code referenced at the source GHSA-p6h4-93qp-jhcm.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
parse-community · parse-serverpublic PoCs found — 1
githubgithub.com/tuo4n8/CVE-2022-24760★ 1⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.