parse-community parse-server up to 6.5.8/7.2.x improper authorization

Summaryinfo

A vulnerability has been found in parse-community parse-server up to 6.5.8/7.2.x and classified as critical. This impacts an unknown function. The manipulation leads to improper authorization. This vulnerability is listed as CVE-2024-47183. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in parse-community parse-server up to 6.5.8/7.2.x. It has been rated as critical. This issue affects an unknown part. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2024-47183 since 09/20/2024. The exploitation is known to be easy. The attack may be initiated remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

Upgrading to version 6.5.9 or 7.3.0 eliminates this vulnerability. Applying the patch 13ee52f0d19ef3a3524b3d79aea100e587eb3cfc is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• parse-community

Name

• parse-server

Version

• 6.5.0
• 6.5.1
• 6.5.2
• 6.5.3
• 6.5.4
• 6.5.5
• 6.5.6
• 6.5.7
• 6.5.8
• 7.0
• 7.1
• 7.2

License

• open-source

Website

• Product: https://github.com/parse-community/parse-server/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion