CVE-2024-47183

Parse Server's custom object ID allows to acquire role privileges

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.

Scores

Weaknesses (CWE)

• CWE-285
• CWE-863

Advisories

• GHSA-8xq9-g7ch-35hg — Parse Server's custom object ID allows to acquire role privileges

European references

• ENISA EUVD · EUVD-2024-3001
• GCVE · GCVE-0-2024-47183

Affected configurations (NVD CPE)

• cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* < 6.5.9
• cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* ≥ 7.0.0 < 7.3.0

Affected products

References

• https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg
• https://github.com/parse-community/parse-server/pull/9317
• https://github.com/parse-community/parse-server/pull/9318
• https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc
• https://github.com/parse-community/parse-server/commit/1bfbccf9ee7ea77533b2b2aa7c4c69f3bd35e66f

Sources