Parse Server up to 4.10.14/5.2.5 User resource transfer

Summaryinfo

A vulnerability categorized as problematic has been discovered in Parse Server up to 4.10.14/5.2.5. This issue affects some unknown processing. Such manipulation of the argument User leads to resource transfer. This vulnerability is listed as CVE-2022-39225. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Parse Server up to 4.10.14/5.2.5. Affected by this issue is an unknown functionality. The manipulation of the argument user with an unknown input leads to a resource transfer vulnerability. Using CWE to declare the problem leads to CWE-669. The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource. Impacted is integrity. CVE summarizes:

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.15, or 5.0.0 and above prior to 5.2.6, a user can write to the session object of another user if the session object ID is known. For example, an attacker can assign the session object to their own user by writing to the `user` field and then read any custom fields of that session object. Note that assigning a session to another user does not usually change the privileges of either of the two users, and a user cannot assign their own session to another user. This issue is patched in version 4.10.15 and above, and 5.2.6 and above. To mitigate this issue in unpatched versions add a `beforeSave` trigger to the `_Session` class and prevent writing if the requesting user is different from the user in the session object.

The weakness was presented 09/23/2022 as GHSA-6w4q-23cf-j9jp. The advisory is available at github.com. This vulnerability is handled as CVE-2022-39225 since 09/02/2022. Technical details are known, but there is no available exploit.

Upgrading to version 4.10.15 or 5.2.6 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Parse Server

Version

• 4.10.0
• 4.10.1
• 4.10.2
• 4.10.3
• 4.10.4
• 4.10.5
• 4.10.6
• 4.10.7
• 4.10.8
• 4.10.9
• 4.10.10
• 4.10.11
• 4.10.12
• 4.10.13
• 4.10.14
• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 5.2.4
• 5.2.5

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion