CVE-2023-36475: Parse Server Prototype Pollution RCE Flaw

CVE-2023-36475 Overview

CVE-2023-36475 is a critical remote code execution vulnerability affecting Parse Server, an open source backend that can be deployed to any infrastructure running Node.js. The vulnerability allows an attacker to leverage a prototype pollution sink to trigger remote code execution through the MongoDB BSON parser. This flaw exists in versions prior to 5.5.2 and 6.2.1, enabling unauthenticated attackers to execute arbitrary code on vulnerable Parse Server instances over the network.

Critical Impact
Unauthenticated remote code execution via prototype pollution in MongoDB BSON parser allows complete server compromise with no user interaction required.

Affected Products

Parse Server versions prior to 5.5.2
Parse Server versions 6.x prior to 6.2.1
parseplatform parse-server (Node.js deployments)

Discovery Timeline

2023-06-28 - CVE-2023-36475 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-36475

Vulnerability Analysis

This vulnerability (CWE-1321: Improperly Controlled Modification of Object Prototype Attributes) stems from insufficient validation of user-controlled input that flows into the MongoDB BSON parser. Prototype pollution occurs when an attacker can inject properties into JavaScript object prototypes, which are then inherited by all objects in the application. In this case, the Parse Server's database controller failed to properly sanitize incoming update operations, allowing malicious payloads to pollute object prototypes and ultimately achieve code execution through the BSON parser's handling of these polluted objects.

The vulnerability is exploitable over the network without authentication or user interaction, and successful exploitation grants the attacker complete control over the confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause lies in the DatabaseController.js file where update operations were processed without checking for prohibited keywords that could be used to manipulate object prototypes. The Parse Server did not validate that incoming data did not contain prototype pollution payloads such as __proto__, constructor, or prototype properties before passing them to the MongoDB BSON parser.

Attack Vector

The attack vector is network-based, targeting Parse Server API endpoints that process database update operations. An attacker crafts malicious JSON payloads containing prototype pollution properties and sends them to the server. When the server processes these payloads through the MongoDB BSON parser, the polluted prototypes enable arbitrary code execution. The attack requires no authentication, no special privileges, and no user interaction.

javascript

// Security patch in src/Controllers/DatabaseController.js
// Source: https://github.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b42844180546d90c7aa90

    validateOnly: boolean = false,
    validSchemaController: SchemaController.SchemaController
  ): Promise<any> {
+    try {
+      Utils.checkProhibitedKeywords(this.options, update);
+    } catch (error) {
+      return Promise.reject(new Parse.Error(Parse.Error.INVALID_KEY_NAME, error));
+    }
    const originalQuery = query;
    const originalUpdate = update;
    // Make a copy of the object, so we don't mutate the incoming data.

The patch introduces a call to Utils.checkProhibitedKeywords() that validates incoming update data for prototype pollution payloads before processing, rejecting any requests containing malicious properties.

Detection Methods for CVE-2023-36475

Indicators of Compromise

Unexpected properties in database objects containing __proto__, constructor, or prototype keys
Unusual Parse Server crashes or unexpected behavior following API requests
Suspicious POST requests to Parse Server endpoints with nested objects containing prototype pollution patterns
Evidence of arbitrary command execution from the Node.js process running Parse Server

Detection Strategies

Monitor Parse Server API endpoints for requests containing prototype pollution patterns (__proto__, constructor.prototype, etc.) in JSON payloads
Implement Web Application Firewall (WAF) rules to detect and block prototype pollution attack signatures
Enable verbose logging on Parse Server to capture and analyze incoming request payloads
Deploy runtime application self-protection (RASP) solutions to detect prototype pollution attempts

Monitoring Recommendations

Review Parse Server access logs for unusual patterns in update operation requests
Set up alerts for INVALID_KEY_NAME errors after patching, which indicate blocked exploitation attempts
Monitor system resources and process spawning from the Node.js Parse Server process
Implement network-level monitoring for outbound connections from the Parse Server that could indicate post-exploitation activity

How to Mitigate CVE-2023-36475

Immediate Actions Required

Upgrade Parse Server to version 5.5.2 or 6.2.1 immediately
If immediate patching is not possible, consider temporarily restricting network access to Parse Server endpoints
Review server logs for indicators of past exploitation attempts
Audit MongoDB collections for evidence of prototype pollution artifacts

Patch Information

Parse Platform has released security patches in versions 5.5.2 and 6.2.1 that address this vulnerability. The fix introduces validation of incoming data through a checkProhibitedKeywords utility function that rejects requests containing prototype pollution payloads. Organizations should upgrade to these patched versions immediately.

Patch commits are available at:

For detailed information, see the GitHub Security Advisory GHSA-462x-c3jw-7vr6.

Workarounds

Implement a reverse proxy or WAF rule to filter requests containing prototype pollution patterns in JSON bodies
Restrict Parse Server API access to trusted IP ranges until patching can be completed
Deploy network segmentation to limit the blast radius of potential compromise
Consider running Parse Server in a containerized environment with restricted capabilities

bash

# Example: Restricting Parse Server access with iptables until patching
# Allow only trusted IP ranges to access Parse Server port
iptables -A INPUT -p tcp --dport 1337 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 1337 -j DROP