CVE-2024-29027
Critical
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal store manipulation or remote code execution. The patch in versions 6.5.5 and 7.0.0-alpha.29 added string sanitation for Cloud Function name and Cloud Job name. As a workaround, sanitize the Cloud Function name and Cloud Job name before it reaches Parse Server.
SeverityCritical
CVSS9.0
Exploit probability—
ProductParseplatform Parse-server
PublishedMar 19, 2024
First seenMar 19, 2024
Weakness typeCWE-74Injection
How to fix
Update
- parseplatform parse-server6.5.5 or later
- parse-server6.5.5, 7.0.0-alpha.29 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| parseplatform parse-server | v < 6.5.5, 7.0.0 | 6.5.5 |
| parse-servernpm | v < 6.5.5, 7.0.0-alpha.1 ≤ v < 7.0.0-alpha.29 | 6.5.5, 7.0.0-alpha.29 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.