Parse Server up to 5.5.4/6.2.1 Parse.Query control flow

Summaryinfo

A vulnerability has been found in Parse Server up to 5.5.4/6.2.1 and classified as problematic. The impacted element is the function Parse.Query. Performing a manipulation results in control flow. This vulnerability was named CVE-2023-41058. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Parse Server up to 5.5.4/6.2.1. This affects the function Parse.Query. The manipulation with an unknown input leads to a control flow vulnerability. CWE is classifying the issue as CWE-670. The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated. This is going to have an impact on confidentiality. The summary by CVE is:

Parse Server is an open source backend server. In affected versions the Parse Cloud trigger `beforeFind` is not invoked in certain conditions of `Parse.Query`. This can pose a vulnerability for deployments where the `beforeFind` trigger is used as a security layer to modify the incoming query. The vulnerability has been fixed by refactoring the internal query pipeline for a more concise code structure and implementing a patch to ensure the `beforeFind` trigger is invoked. This fix was introduced in commit `be4c7e23c6` and has been included in releases 6.2.2 and 5.5.5. Users are advised to upgrade. Users unable to upgrade should make use of parse server's security layers to manage access levels with Class-Level Permissions and Object-Level Access Control that should be used instead of custom security layers in Cloud Code triggers.

The weakness was presented 09/05/2023 as GHSA-fcv6-fg5r-jm9q. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2023-41058 since 08/22/2023. Technical details are known, but no exploit is available.

Upgrading to version 5.5.5 or 6.2.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch be4c7e23c63a2fb690685665cebed0de26be05c5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Parse Server

Version

• 5.5.0
• 5.5.1
• 5.5.2
• 5.5.3
• 5.5.4
• 6.2.0
• 6.2.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion