CVE-2022-24760: falha crítica em parse-community parse-server
Command Injection in Parse server
Publicada em · Atualizada em
60Vexday Risk Score
Acompanhe. Ela tem prova de conceito pública.
ssvc Attendcvss 10epss 49%
da publicação à arma20 dias
Publicada no NVD11 de mar.
1ª PoC+20d
probabilidade de exploração
49%top 1% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file `DatabaseController.js`, so it is likely to affect Postgres and any other database backend as well. This vulnerability has been confirmed on Linux (Ubuntu) and Windows. Users are advised to upgrade as soon as possible. The only known workaround is to manually patch your installation with code referenced at the source GHSA-p6h4-93qp-jhcm.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
parse-community · parse-serverPoCs públicas encontradas — 1
githubgithub.com/tuo4n8/CVE-2022-24760★ 1⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — parse-community parse-server
No mesmo produto, das mais perigosas para as menos.
CVE-2022-39396CRITICALParse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parserEPSS 38.7%CVE-2024-39309CRITICALZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass VulnerabilityEPSS 20.2%CVE-2023-36475CRITICALParse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollutionEPSS 3.2%CVE-2021-39187HIGHCrash server with query parameterEPSS 1.8%CVE-2026-30965CRITICALParse Server session token exfiltration via `redirectClassNameForKey` query parameterEPSS 1.6%CVE-2022-31112HIGHProtected fields exposed via LiveQuery in parse-serverEPSS 1.3%