요약
- CVE-2024-47183은(는) parse-server (parseplatform), parse-server에 영향을 주는 높음 (CVSS 8.1) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.42%, 전체 취약점의 36.0%보다 높음.
- 조치: 7.3.0, 6.5.9 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| parse-server | ≥ 7.0.0, < 7.3.0< 6.5.9
| 7.3.06.5.9
|
| parse-server npm | ≥ 7.0.0, < 7.3.0< 6.5.9
| 7.3.06.5.9
|
Description
Impact
If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role.
Patches
Improved validation for custom user object IDs. Session tokens for existing users with an object ID that exploits the vulnerability are now rejected.
Workarounds
- Disable custom object IDs by setting
allowCustomObjectId: false or not setting the option which defaults to false.
- Use a Cloud Code Trigger to validate that a new user's object ID doesn't start with the prefix
role:.
References
NVD description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free