CVE-2022-24760: critical vulnerability in parse-community parse-server
Command Injection in Parse server
Published · Updated
60Vexday Risk Score
Keep watching. It has a public proof of concept.
ssvc Attendcvss 10epss 49%
from disclosure to weapon20 days
Published on NVDMar 11
1st PoC+20d
exploitation probability
49%top 1% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file `DatabaseController.js`, so it is likely to affect Postgres and any other database backend as well. This vulnerability has been confirmed on Linux (Ubuntu) and Windows. Users are advised to upgrade as soon as possible. The only known workaround is to manually patch your installation with code referenced at the source GHSA-p6h4-93qp-jhcm.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
parse-community · parse-serverpublic PoCs found — 1
githubgithub.com/tuo4n8/CVE-2022-24760★ 1⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — parse-community parse-server
In the same product, most dangerous first.
CVE-2022-39396CRITICALParse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parserEPSS 38.7%CVE-2024-39309CRITICALZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass VulnerabilityEPSS 20.2%CVE-2023-36475CRITICALParse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollutionEPSS 3.2%CVE-2021-39187HIGHCrash server with query parameterEPSS 1.8%CVE-2026-30965CRITICALParse Server session token exfiltration via `redirectClassNameForKey` query parameterEPSS 1.6%CVE-2022-31112HIGHProtected fields exposed via LiveQuery in parse-serverEPSS 1.3%