CVE-2023-36475
📋 TL;DR
This vulnerability in Parse Server allows attackers to perform prototype pollution attacks that can lead to remote code execution through the MongoDB BSON parser. Any Parse Server deployment prior to versions 5.5.2 or 6.2.1 is affected. Attackers can potentially take full control of affected servers.
💻 Affected Systems
- Parse Server
📦 What is this software?
Parse Server by Parseplatform
Parse Server by Parseplatform
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining remote code execution, data exfiltration, and persistent backdoor installation.
Likely Case
Remote code execution leading to data theft, service disruption, and lateral movement within the network.
If Mitigated
Limited impact with proper network segmentation, but still potential for service disruption if exploited.
🎯 Exploit Status
The vulnerability is publicly documented with proof-of-concept available, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.5.2 or 6.2.1
Vendor Advisory: https://github.com/parse-community/parse-server/releases/tag/5.5.2
Restart Required: Yes
Instructions:
1. Update Parse Server to version 5.5.2 or 6.2.1 using npm update parse-server. 2. Restart the Parse Server application. 3. Verify the update was successful.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to Parse Server instances to minimize attack surface
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach Parse Server
- Deploy web application firewall rules to detect and block prototype pollution attempts
🔍 How to Verify
Check if Vulnerable:
Check package.json for Parse Server version or run 'npm list parse-server'Check Version:
npm list parse-server | grep parse-serverVerify Fix Applied:
Verify installed version is 5.5.2 or higher (for 5.x) or 6.2.1 or higher (for 6.x)📡 Detection & Monitoring
Log Indicators:
- Unusual MongoDB BSON parsing errors
- Unexpected process spawns from Parse Server
- Prototype pollution related error messages
Network Indicators:
- Unusual outbound connections from Parse Server
- Suspicious payloads containing __proto__ or constructor properties
SIEM Query:
process.name:"node" AND (process.args:"parse-server" OR process.parent.name:"parse-server") AND event.action:"process_start"🔗 References
- https://github.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b42844180546d90c7aa90
- https://github.com/parse-community/parse-server/commit/5fad2928fb8ee17304abcdcf259932f827d8c81f
- https://github.com/parse-community/parse-server/issues/8674
- https://github.com/parse-community/parse-server/issues/8675
- https://github.com/parse-community/parse-server/releases/tag/5.5.2
- https://github.com/parse-community/parse-server/releases/tag/6.2.1
- https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6
- https://github.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b42844180546d90c7aa90
- https://github.com/parse-community/parse-server/commit/5fad2928fb8ee17304abcdcf259932f827d8c81f
- https://github.com/parse-community/parse-server/issues/8674
- https://github.com/parse-community/parse-server/issues/8675
- https://github.com/parse-community/parse-server/releases/tag/5.5.2
- https://github.com/parse-community/parse-server/releases/tag/6.2.1
- https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6
