CVE-2024-47183

Parse Server's custom object ID allows to acquire role privileges

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.

Scores

Faiblesses (CWE)

• CWE-285
• CWE-863

Avis

• GHSA-8xq9-g7ch-35hg — Parse Server's custom object ID allows to acquire role privileges

Références européennes

• ENISA EUVD · EUVD-2024-3001
• GCVE · GCVE-0-2024-47183

Configurations affectées (CPE NVD)

• cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* < 6.5.9
• cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* ≥ 7.0.0 < 7.3.0

Produits affectés

Références

• https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg
• https://github.com/parse-community/parse-server/pull/9317
• https://github.com/parse-community/parse-server/pull/9318
• https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc
• https://github.com/parse-community/parse-server/commit/1bfbccf9ee7ea77533b2b2aa7c4c69f3bd35e66f

Sources