CVE-2024-47183
📋 TL;DR
Parse Server versions before 6.5.9 and 7.3.0 with allowCustomObjectId enabled are vulnerable to privilege escalation. An attacker who can create new users can set custom object IDs to gain unauthorized role privileges. This affects any Parse Server deployment with the vulnerable configuration.
💻 Affected Systems
- Parse Server
📦 What is this software?
Parse Server by Parseplatform
Parse Server by Parseplatform
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains administrative privileges, leading to complete system compromise, data exfiltration, or service disruption.
Likely Case
Attacker escalates to privileged roles, accessing sensitive data or performing unauthorized actions within the application.
If Mitigated
With proper access controls and monitoring, impact is limited to unauthorized role access within the compromised user's scope.
🎯 Exploit Status
Exploitation requires user creation permissions. The vulnerability is well-documented in the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.5.9 or 7.3.0
Vendor Advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg
Restart Required: Yes
Instructions:
1. Update Parse Server to version 6.5.9 or 7.3.0 using npm update parse-server. 2. Restart the Parse Server application. 3. Verify the update with npm list parse-server.
🔧 Temporary Workarounds
Disable allowCustomObjectId
allSet allowCustomObjectId: false in Parse Server configuration to prevent exploitation.
Edit parse-server configuration file and set allowCustomObjectId: false
🧯 If You Can't Patch
- Implement strict access controls to limit user creation permissions.
- Monitor logs for unusual user creation patterns or role assignment attempts.
🔍 How to Verify
Check if Vulnerable:
Check Parse Server version and configuration. If version <6.5.9 or 7.x <7.3.0 and allowCustomObjectId: true, system is vulnerable.Check Version:
npm list parse-serverVerify Fix Applied:
Confirm Parse Server version is 6.5.9 or 7.3.0+ and test user creation with custom object IDs.📡 Detection & Monitoring
Log Indicators:
- Unusual user creation events with custom object IDs
- Role assignment to newly created users
Network Indicators:
- HTTP POST requests to user creation endpoints with custom objectId parameters
SIEM Query:
source="parse-server" AND (event="user_creation" OR event="role_assignment") AND objectId=*🔗 References
- https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc
- https://github.com/parse-community/parse-server/commit/1bfbccf9ee7ea77533b2b2aa7c4c69f3bd35e66f
- https://github.com/parse-community/parse-server/pull/9317
- https://github.com/parse-community/parse-server/pull/9318
- https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg
