CVE-2022-36079 : Exploit Details and Defense Strategies

Parse Server is susceptible to a security vulnerability that allows attackers to brute force guess sensitive user data via search patterns. This article provides an overview of the CVE-2022-36079 vulnerability, its impact, technical details, and mitigation steps.

Understanding CVE-2022-36079

Parse Server vulnerability to brute force guessing of user sensitive data via search patterns

What is CVE-2022-36079?

Parse Server, an open-source backend deployed on Node.js infrastructure, allows internal and protected fields to be used as query constraints. Versions prior to 4.10.14 or 5.2.5 permit guessing of these fields until a response object is returned. A patch in versions 4.10.14 and 5.2.5 now requires a master key for query constraints. Workaround involves implementing a Parse Cloud Trigger 'beforeFind' to manually remove query constraints.

The Impact of CVE-2022-36079

The vulnerability has a CVSS base score of 8.6 (High severity). Attack vector is over network with low attack complexity. It has high confidentiality impact but no integrity impact. There are no privileges required for exploitation, and user interaction is not necessary. Scope of impact is changed.

Technical Details of CVE-2022-36079

Vulnerability Description

Parse Server vulnerability allows guessing of internal and protected fields as query constraints, exposing sensitive user data.

Affected Systems and Versions

Products affected: parse-server by parse-community

Versions < 4.10.14
Versions >= 5.0.0, < 5.2.5

Exploitation Mechanism

The issue arises due to query constraints that enable attackers to enumerate and guess internal or protected fields until a response object is returned.

Mitigation and Prevention

Immediate Steps to Take

To mitigate the vulnerability, update Parse Server to version 4.10.14 or 5.2.5. Implement a Parse Cloud Trigger 'beforeFind' to manually remove query constraints.

Long-Term Security Practices

Regularly update Parse Server to the latest version, apply security patches promptly, and monitor for any suspicious activities indicating exploitation.

Patching and Updates

Refer to the GitHub Parse Server repository for the available patches and updates to address CVE-2022-36079.