CVE-2022-24760: Parse Server RCE Vulnerability

CVE-2022-24760 Overview

Parse Server is an open source HTTP web server backend widely used for building scalable applications. A critical Remote Code Execution (RCE) vulnerability exists in versions prior to 4.10.7 that allows attackers to execute arbitrary code on the server. The vulnerability is rooted in Prototype Pollution within the DatabaseController.js file, affecting Parse Server in its default configuration with MongoDB and likely impacting other database backends including Postgres.

Critical Impact

This vulnerability enables unauthenticated remote code execution through prototype pollution, potentially allowing complete server compromise on both Linux (Ubuntu) and Windows systems.

Affected Products

• Parse Platform Parse Server (versions prior to 4.10.7)
• Canonical Ubuntu Linux
• Microsoft Windows

Discovery Timeline

• 2022-03-12 - CVE-2022-24760 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-24760

Vulnerability Analysis

This vulnerability represents a severe security flaw combining Prototype Pollution with Remote Code Execution. The weakness originates in the DatabaseController.js file where improper handling of object properties allows attackers to manipulate JavaScript object prototypes. By polluting the prototype chain, attackers can inject malicious properties that are inherited by other objects throughout the application, ultimately leading to arbitrary code execution.

The vulnerability is particularly dangerous because it affects Parse Server in its default configuration. The attack surface spans multiple database backends—while confirmed on MongoDB configurations, the underlying prototype pollution flaw in the core controller logic suggests Postgres and other backends are equally vulnerable.

Root Cause

The root cause stems from CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The application fails to properly sanitize or validate object properties before processing, allowing attackers to inject __proto__ or constructor.prototype properties that pollute the JavaScript prototype chain.

Attack Vector

The attack is network-accessible, requiring no authentication or user interaction. An attacker can craft malicious HTTP requests containing specially formatted JSON payloads that exploit the prototype pollution vulnerability. When the Parse Server processes these requests through the DatabaseController, the polluted prototype propagates through the application, enabling code execution. The attack has been confirmed functional on both Linux (Ubuntu) and Windows operating systems.

The following patches were applied to address the vulnerability:

     literalValue = t.arrayExpression(array.map((value) => {
       if (typeof value == 'string') {
         return t.stringLiteral(value);
+      } else if (typeof value == 'number') {
+        return t.numericLiteral(value);
+      } else if (typeof value == 'object') {
+        const object = parsers.objectParser(value);
+        const props = Object.entries(object).map(([k, v]) => {
+          if (typeof v == 'string') {
+            return t.objectProperty(t.identifier(k), t.stringLiteral(v));
+          } else if (typeof v == 'number') {
+            return t.objectProperty(t.identifier(k), t.numericLiteral(v));
+          } else if (typeof v == 'boolean') {
+            return t.objectProperty(t.identifier(k), t.booleanLiteral(v));
+          }
+        });
+        return t.objectExpression(props);
       } else {
         throw new Error('Unable to parse array');
       }

Source: GitHub Commit

Additional changes were made to the Config.js file to properly initialize the DatabaseController:

           cacheInfo.schemaCacheTTL,
           cacheInfo.enableSingleSchemaCache
         );
-        config.database = new DatabaseController(cacheInfo.databaseController.adapter, schemaCache);
+        config.database = new DatabaseController(
+          cacheInfo.databaseController.adapter,
+          schemaCache,
+          config
+        );
       } else {
         config[key] = cacheInfo[key];
       }

Source: GitHub Commit

Detection Methods for CVE-2022-24760

Indicators of Compromise

• Unusual HTTP requests containing __proto__, constructor, or prototype in JSON payloads targeting Parse Server endpoints
• Unexpected child processes spawned by the Node.js Parse Server process
• Anomalous modifications to object prototypes in application memory
• Suspicious outbound network connections from the Parse Server instance

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block requests containing prototype pollution payloads
• Monitor application logs for malformed JSON requests or unexpected parsing errors in DatabaseController.js
• Implement runtime application self-protection (RASP) to detect prototype manipulation attempts
• Use SentinelOne's Singularity Platform to detect and block post-exploitation activities such as command execution

Monitoring Recommendations

• Enable detailed logging for all Parse Server API endpoints and monitor for anomalous request patterns
• Configure alerts for any process creation or system calls originating from the Node.js runtime
• Monitor file system changes within the Parse Server installation directory
• Track network connections from Parse Server instances to identify potential command-and-control communications

How to Mitigate CVE-2022-24760

Immediate Actions Required

• Upgrade Parse Server to version 4.10.7 or later immediately
• Audit Parse Server access logs for any suspicious requests containing prototype pollution patterns
• Isolate affected Parse Server instances until patching is complete
• Review and restrict network access to Parse Server endpoints using firewall rules

Patch Information

The Parse Server team has addressed this vulnerability in version 4.10.7. The security fix is available through the official GitHub repository commit 886bfd7cac69496e3f73d4bb536f0eec3cba0e4d. Users should upgrade immediately by updating their Node.js package dependencies. For detailed patch information, refer to the GitHub Security Advisory GHSA-p6h4-93qp-jhcm.

Workarounds

• Manually apply the security patch from GitHub commit 886bfd7 if immediate upgrade is not possible
• Implement input validation middleware to reject requests containing prototype pollution payloads
• Use Object.freeze() on critical objects to prevent prototype modification
• Deploy a reverse proxy with request filtering to block malicious payloads before they reach Parse Server

# Upgrade Parse Server to patched version
npm update parse-server@4.10.7

# Verify installed version
npm list parse-server

# For yarn users
yarn upgrade parse-server@4.10.7