CVE-2024-29027: Parse Server Cloud Function RCE Vulnerability

CVE-2024-29027 Overview

Parse Server, an open source backend that can be deployed to any infrastructure running Node.js, contains a critical code injection vulnerability in its Cloud Function and Cloud Job name handling. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal store manipulation, or remote code execution.

Critical Impact
This vulnerability enables attackers to inject malicious properties into the internal store by crafting specially formed Cloud Function or Cloud Job names containing quote characters, potentially leading to remote code execution on affected Parse Server instances.

Affected Products

Parse Server versions prior to 6.5.5
Parse Server 7.0.0-alpha.1 through 7.0.0-alpha.28
All Parse Server deployments running on Node.js infrastructure without input sanitization

Discovery Timeline

March 19, 2024 - CVE-2024-29027 published to NVD
December 17, 2025 - Last updated in NVD database

Technical Details for CVE-2024-29027

Vulnerability Analysis

The vulnerability exists in the getStore function within src/triggers.js, which handles Cloud Function and Cloud Job name resolution. The function fails to sanitize input names before processing them, allowing attackers to inject quote characters (single quotes, double quotes, or backticks) into the name parameter. This lack of input validation enables malicious users to inject properties into the internal store structure, bypassing expected control flow and potentially achieving code execution.

The attack can be performed remotely over the network without authentication, though exploitation requires specific conditions to be met, resulting in high attack complexity. When successfully exploited, the vulnerability affects the confidentiality, integrity, and availability of the Parse Server instance, with the potential for changed scope impacting other components beyond the vulnerable system.

Root Cause

The root cause is improper input validation (CWE-74: Injection) in the getStore function. The function accepts user-controlled Cloud Function and Cloud Job names and processes them through a path-splitting operation without first validating that the name does not contain special characters. Quote characters in the name can be leveraged to manipulate how the function constructs and accesses the internal store, enabling property injection attacks.

Attack Vector

An attacker can exploit this vulnerability by sending HTTP requests to the Parse Server with crafted Cloud Function or Cloud Job names containing injection characters. The network-based attack vector requires no user interaction, though the high complexity indicates specific conditions must be met for successful exploitation. The attack can result in:

Server crash (Denial of Service)
Internal store manipulation
Code injection leading to potential remote code execution

javascript

// Security patch from src/triggers.js
function getStore(category, name, applicationId) {
  const invalidNameRegex = /['"`]/;
  if (invalidNameRegex.test(name)) {
    // Prevent a malicious user from injecting properties into the store
    return {};
  }

  const path = name.split('.');
  path.splice(-1); // remove last component
  applicationId = applicationId || Parse.applicationId;

Source: GitHub Commit 5ae6d6a

Detection Methods for CVE-2024-29027

Indicators of Compromise

Unexpected server crashes or restarts in Parse Server instances
HTTP requests to Cloud Function endpoints containing quote characters (', ", or backticks) in function names
Anomalous entries in server logs showing malformed Cloud Function or Cloud Job names
Unexplained modifications to internal application state or configuration

Detection Strategies

Monitor Parse Server logs for requests containing quote characters in Cloud Function or Cloud Job name parameters
Implement Web Application Firewall (WAF) rules to detect and block requests with injection patterns in function name fields
Deploy runtime application self-protection (RASP) to detect property injection attempts in Node.js applications
Set up alerting for Parse Server process crashes or unexpected terminations

Monitoring Recommendations

Enable verbose logging on Parse Server to capture all Cloud Function and Cloud Job invocation attempts
Configure centralized log aggregation to correlate potential attack patterns across multiple Parse Server instances
Implement application performance monitoring (APM) to detect anomalous server behavior indicative of exploitation attempts
Monitor for unusual network traffic patterns targeting Parse Server endpoints

How to Mitigate CVE-2024-29027

Immediate Actions Required

Upgrade Parse Server to version 6.5.5 or later for stable releases
Upgrade Parse Server to version 7.0.0-alpha.29 or later for alpha releases
Implement input validation at the API gateway or load balancer level to filter malicious requests
Review server logs for evidence of exploitation attempts prior to patching

Patch Information

The Parse Server maintainers have addressed this vulnerability by adding string sanitization for Cloud Function and Cloud Job names. The fix validates input names against a regex pattern that detects single quotes, double quotes, and backticks, returning an empty object instead of processing potentially malicious names.

Patched versions are available:

Parse Server 6.5.5 (stable)
Parse Server 7.0.0-alpha.29 (alpha)

For additional details, refer to the GitHub Security Advisory GHSA-6hh7-46r2-vf29.

Workarounds

Implement custom middleware to sanitize Cloud Function and Cloud Job names before they reach Parse Server
Deploy a reverse proxy or WAF with rules to block requests containing quote characters in function name parameters
Restrict network access to Parse Server endpoints to trusted sources only
Consider temporarily disabling Cloud Functions if they are not critical to operations until patching is complete

bash

# Example NGINX configuration to block malicious requests
location /parse/functions/ {
    # Block requests with quote characters in the URI
    if ($request_uri ~* "['\"` ]") {
        return 403;
    }
    proxy_pass http://parse-server:1337;
}