ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability

緊急 9.8CVE-2024-39309 · BIT-parse-2024-39309 · GHSA-c2hr-cqg6-8j6r · 01/07/2024 公開 · 17/06/2026 更新

要点

CVE-2024-39309 は parse-server に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：20.2%（全脆弱性の 97.5% より高い）。
対処：7.1.0, 6.5.7 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
parse-server npm	`≥ 7.0.0, < 7.1.0< 6.5.7`	`7.1.06.5.7`

概要

Impact

This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database.

Patches

The algorithm to detect SQL injection has been improved.

Workarounds

None.

References

https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r
https://github.com/parse-community/parse-server/pull/9167 (fix for Parse Server 7)
https://github.com/parse-community/parse-server/pull/9168 (fix for Parse Server 6)

Credits

Smile Thanapattheerakul of Trend Micro (finder)
Manuel Trezza (coordinator)

NVD の説明

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to detect SQL injection has been improved in versions 6.5.7 and 7.1.0. No known workarounds are available.