CVE-2024-47183
Parse Server's custom object ID allows to acquire role privileges
Impact
### Impact If the Parse Server option `allowCustomObjectId: true` is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. ### Patches Improved validation for custom user object IDs. Session tokens for existing users with an object ID that exploits the vulnerability are now rejected. ### Workarounds - Disable custom object IDs by setting `allowCustomObjectId: false` or not setting the option which defaults to `false`. - Use a Cloud Code Trigger to validate that a new user's object ID doesn't start with the prefix `role:`. ### References - https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg - https://github.com/parse-community/parse-server/pull/9317 (fix for Parse Server 7) - https://github.com/parse-community/parse-server/pull/9318 (fix for Parse Server 6)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | parse-server | < 6.5.9 | 6.5.9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Parseplatform | Parse-Server | before 6.5.9 from 7.0.0 before 7.3.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc
- https://github.com/parse-community/parse-server/commit/1bfbccf9ee7ea77533b2b2aa7c4c69f3bd35e66f
- https://github.com/parse-community/parse-server/pull/9317
- https://github.com/parse-community/parse-server/pull/9318
- https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg
- https://github.com/advisories/GHSA-8xq9-g7ch-35hg
- https://nvd.nist.gov/vuln/detail/CVE-2024-47183