Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution

Description

An attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 6.0.0, < 6.2.1

  < 5.5.2**

• Patched version(s): **6.2.1

  5.5.2**

References

• GHSA-462x-c3jw-7vr6
• CVE-2023-36475
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Remote code execution via MongoDB BSON parser through prototype pollution - CVE-2022-39396
• Parse Server vulnerable to Prototype Pollution via Cloud Code Webhooks or Cloud Code Triggers - CVE-2022-41878
• Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks - CVE-2022-41879
• fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name - CVE-2023-26920

Tags:

npm

parse-server