GitHub Advisoryadvisory · npm
GHSA-6hh7-46r2-vf29 Server crashes on invalid Cloud Function or Cloud Job name
CRITICAL
Official page ↗
- Aliases
- CVE-2024-29027
- Ecosystem
- npm
- Packages
- parse-server
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
- Weaknesses
- CWE-20, CWE-74
- Reviewed
- 2024-03-19
Affected packages
• npm parse-server: < 6.5.5 → fixed in 6.5.5
• npm parse-server: >= 7.0.0-alpha.1, < 7.0.0-alpha.29 → fixed in 7.0.0-alpha.29
Description
Impact
Calling an invalid Parse Server Cloud Function name or Cloud Job name crashes server and may allow for code injection.
Patches
Added string sanitation for Cloud Function name and Cloud Job name.
Workarounds
Sanitize the Cloud Function name and Cloud Job name before it reaches Parse Server.
References
• https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29
• https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29 (Fix for Parse Server 7 alpha)
• https://github.com/parse-community/parse-server/releases/tag/6.5.5 (Fix for Parse Server 6 LTS)
Related
Alias · CVE (1)
- CVE-2024-29027 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. vulnerability
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29 web
- https://nvd.nist.gov/vuln/detail/CVE-2024-29027 advisory
- https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b web
- https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e web
- https://github.com/parse-community/parse-server package
- https://github.com/parse-community/parse-server/releases/tag/6.5.5 web
- https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29 web