CVE-2023-36475: Parse Server Prototype Pollution RCE Flaw

CVE-2023-36475 Overview

CVE-2023-36475 is a critical remote code execution vulnerability affecting Parse Server, an open source backend that can be deployed to any infrastructure running Node.js. The vulnerability allows an attacker to leverage a prototype pollution sink to trigger remote code execution through the MongoDB BSON parser. This flaw exists in versions prior to 5.5.2 and 6.2.1, enabling unauthenticated attackers to execute arbitrary code on vulnerable Parse Server instances over the network.

Critical Impact

Unauthenticated remote code execution via prototype pollution in MongoDB BSON parser allows complete server compromise with no user interaction required.

Affected Products

• Parse Server versions prior to 5.5.2
• Parse Server versions 6.x prior to 6.2.1
• parseplatform parse-server (Node.js deployments)

Discovery Timeline

• 2023-06-28 - CVE-2023-36475 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-36475

Vulnerability Analysis

This vulnerability (CWE-1321: Improperly Controlled Modification of Object Prototype Attributes) stems from insufficient validation of user-controlled input that flows into the MongoDB BSON parser. Prototype pollution occurs when an attacker can inject properties into JavaScript object prototypes, which are then inherited by all objects in the application. In this case, the Parse Server's database controller failed to properly sanitize incoming update operations, allowing malicious payloads to pollute object prototypes and ultimately achieve code execution through the BSON parser's handling of these polluted objects.

The vulnerability is exploitable over the network without authentication or user interaction, and successful exploitation grants the attacker complete control over the confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause lies in the DatabaseController.js file where update operations were processed without checking for prohibited keywords that could be used to manipulate object prototypes. The Parse Server did not validate that incoming data did not contain prototype pollution payloads such as __proto__, constructor, or prototype properties before passing them to the MongoDB BSON parser.

Attack Vector

The attack vector is network-based, targeting Parse Server API endpoints that process database update operations. An attacker crafts malicious JSON payloads containing prototype pollution properties and sends them to the server. When the server processes these payloads through the MongoDB BSON parser, the polluted prototypes enable arbitrary code execution. The attack requires no authentication, no special privileges, and no user interaction.

// Security patch in src/Controllers/DatabaseController.js
// Source: https://github.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b42844180546d90c7aa90

    validateOnly: boolean = false,
    validSchemaController: SchemaController.SchemaController
  ): Promise<any> {
+    try {
+      Utils.checkProhibitedKeywords(this.options, update);
+    } catch (error) {
+      return Promise.reject(new Parse.Error(Parse.Error.INVALID_KEY_NAME, error));
+    }
    const originalQuery = query;
    const originalUpdate = update;
    // Make a copy of the object, so we don't mutate the incoming data.

The patch introduces a call to Utils.checkProhibitedKeywords() that validates incoming update data for prototype pollution payloads before processing, rejecting any requests containing malicious properties.

Detection Methods for CVE-2023-36475

Indicators of Compromise

• Unexpected properties in database objects containing __proto__, constructor, or prototype keys
• Unusual Parse Server crashes or unexpected behavior following API requests
• Suspicious POST requests to Parse Server endpoints with nested objects containing prototype pollution patterns
• Evidence of arbitrary command execution from the Node.js process running Parse Server

Detection Strategies

• Monitor Parse Server API endpoints for requests containing prototype pollution patterns (__proto__, constructor.prototype, etc.) in JSON payloads
• Implement Web Application Firewall (WAF) rules to detect and block prototype pollution attack signatures
• Enable verbose logging on Parse Server to capture and analyze incoming request payloads
• Deploy runtime application self-protection (RASP) solutions to detect prototype pollution attempts

Monitoring Recommendations

• Review Parse Server access logs for unusual patterns in update operation requests
• Set up alerts for INVALID_KEY_NAME errors after patching, which indicate blocked exploitation attempts
• Monitor system resources and process spawning from the Node.js Parse Server process
• Implement network-level monitoring for outbound connections from the Parse Server that could indicate post-exploitation activity

How to Mitigate CVE-2023-36475

Immediate Actions Required

• Upgrade Parse Server to version 5.5.2 or 6.2.1 immediately
• If immediate patching is not possible, consider temporarily restricting network access to Parse Server endpoints
• Review server logs for indicators of past exploitation attempts
• Audit MongoDB collections for evidence of prototype pollution artifacts

Patch Information

Parse Platform has released security patches in versions 5.5.2 and 6.2.1 that address this vulnerability. The fix introduces validation of incoming data through a checkProhibitedKeywords utility function that rejects requests containing prototype pollution payloads. Organizations should upgrade to these patched versions immediately.

Patch commits are available at:

• GitHub Commit for v5.5.x
• GitHub Commit for v6.2.x

For detailed information, see the GitHub Security Advisory GHSA-462x-c3jw-7vr6.

Workarounds

• Implement a reverse proxy or WAF rule to filter requests containing prototype pollution patterns in JSON bodies
• Restrict Parse Server API access to trusted IP ranges until patching can be completed
• Deploy network segmentation to limit the blast radius of potential compromise
• Consider running Parse Server in a containerized environment with restricted capabilities

# Example: Restricting Parse Server access with iptables until patching
# Allow only trusted IP ranges to access Parse Server port
iptables -A INPUT -p tcp --dport 1337 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 1337 -j DROP