CVE-2022-39396criticalCWE-1321

CVE-2022-39396: critical vulnerability in parse-community parse-server

Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser

Published · Updated

40Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 39%
exploitation probability
39%top 1% of all CVEs
observed exploitation
nono source reports it
In short

Parse Server has a critical flaw that allows attackers to run malicious code on the server by exploiting how it processes MongoDB data. An attacker can trick the system into executing commands without needing any special permissions.

Technical detail

Prototype pollution vulnerability in the MongoDB BSON parser allows unauthenticated remote attackers to achieve arbitrary code execution by injecting malicious properties into JavaScript objects during deserialization. Affected versions prior to 4.10.18 and 5.3.1 lack proper input validation on BSON parsing, enabling exploitation through crafted MongoDB query payloads.

Summary generated and translated by AI from the official description.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.18, and prior to 5.3.1 on the 5.X branch, are vulnerable to Remote Code Execution via prototype pollution. An attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. This issue is patched in version 5.3.1 and in 4.10.18. There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
parse-community · parse-server
Related CVEs — parse-community parse-server

In the same product, most dangerous first.

CVE-2022-24760CRITICALCommand Injection in Parse serverEPSS 49.1%CVE-2024-39309CRITICALZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass VulnerabilityEPSS 20.2%CVE-2023-36475CRITICALParse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollutionEPSS 3.2%CVE-2021-39187HIGHCrash server with query parameterEPSS 1.8%CVE-2026-30965CRITICALParse Server session token exfiltration via `redirectClassNameForKey` query parameterEPSS 1.6%CVE-2022-31112HIGHProtected fields exposed via LiveQuery in parse-serverEPSS 1.3%
References
https://github.com/parse-community/parse-server/security/advisories/GHSA-prm5-8g2m-24gg