Vulnerability Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Internal fields (keys used internally by Parse Server, prefixed by `_`) and protected fields (user defined) can be used as query constraints. Internal and protected fields are removed by Parse Server and are only returned to the client using a valid master key. However, using query constraints, these fields can be guessed by enumerating until Parse Server, prior to versions 4.10.14 or 5.2.5, returns a response object. The patch available in versions 4.10.14 and 5.2.5 requires the maser key to use internal and protected fields as query constraints. As a workaround, implement a Parse Cloud Trigger `beforeFind` and manually remove the query constraints.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Parseplatform | Parse-Server | < 4.10.14 |
Related Weaknesses (CWE)
References
- https://github.com/parse-community/parse-server/commit/634c44acd18f6ee6ec60fac89PatchThird Party Advisory
- https://github.com/parse-community/parse-server/commit/e39d51bd329cd978589983bd6PatchThird Party Advisory
- https://github.com/parse-community/parse-server/issues/8143Issue TrackingThird Party Advisory
- https://github.com/parse-community/parse-server/issues/8144Issue TrackingThird Party Advisory
- https://github.com/parse-community/parse-server/releases/tag/4.10.14Release NotesThird Party Advisory
- https://github.com/parse-community/parse-server/releases/tag/5.2.5Release NotesThird Party Advisory
- https://github.com/parse-community/parse-server/security/advisories/GHSA-2m6g-crThird Party Advisory
- https://github.com/parse-community/parse-server/commit/634c44acd18f6ee6ec60fac89PatchThird Party Advisory
- https://github.com/parse-community/parse-server/commit/e39d51bd329cd978589983bd6PatchThird Party Advisory
- https://github.com/parse-community/parse-server/issues/8143Issue TrackingThird Party Advisory
- https://github.com/parse-community/parse-server/issues/8144Issue TrackingThird Party Advisory
- https://github.com/parse-community/parse-server/releases/tag/4.10.14Release NotesThird Party Advisory
- https://github.com/parse-community/parse-server/releases/tag/5.2.5Release NotesThird Party Advisory
- https://github.com/parse-community/parse-server/security/advisories/GHSA-2m6g-crThird Party Advisory
FAQ
What is CVE-2022-36079?
CVE-2022-36079 is a vulnerability with a CVSS score of 8.6 (HIGH). Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Internal fields (keys used internally by Parse Server, prefixed by `_`) and protected fields (us...
How severe is CVE-2022-36079?
CVE-2022-36079 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-36079?
Check the references section above for vendor advisories and patch information. Affected products include: Parseplatform Parse-Server.