CVE-2022-41878 : Security Advisory and Response

Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers.

Understanding CVE-2022-41878

What is CVE-2022-41878?

Parse Server, an open-source backend for Node.js, is vulnerable to prototype pollution and injection in versions prior to 5.3.2 or 4.10.19. Attackers can inject keywords specified in the

requestKeywordDenylist

via Cloud Code Webhooks or Triggers, bypassing security measures.

The Impact of CVE-2022-41878

This high-severity vulnerability allows unauthorized keyword injections, leading to potential database compromises, data manipulation, and service disruptions.

Technical Details of CVE-2022-41878

Vulnerability Description

The vulnerability stems from improper keyword handling in Parse Server's

requestKeywordDenylist

, enabling injection attacks via Cloud Code Webhooks or Triggers.

Affected Systems and Versions

Versions prior to 4.10.19 and 5.3.2 of Parse Server are affected by this vulnerability.

Exploitation Mechanism

Attackers can exploit this vulnerability by injecting keywords through Cloud Code Webhooks or Triggers, evading keyword denylist restrictions.

Mitigation and Prevention

Immediate Steps to Take

Upgrade to Parse Server versions 4.10.19 or 5.3.2 to mitigate this vulnerability. If an immediate upgrade is not feasible, implement the following workarounds:

Configure firewalls to restrict requests to Parse Server Cloud Code Webhooks API
Block the API if not in use

Long-Term Security Practices

Regularly update Parse Server to the latest versions and follow secure coding practices to prevent injection vulnerabilities.

Patching and Updates

Refer to the advisory provided by Parse Server community for detailed instructions on patching the vulnerability.