CVE-2023-22474
published 2023-02-03CVE-2023-22474: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for`…
PriorityP346high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.66%
47.1th percentile
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for` to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various features in Parse Server. This allows to circumvent the security mechanism of the Parse Server option `masterKeyIps` by setting an allowed IP address as the `x-forwarded-for` header value. This issue has been patched in version 5.4.1. The mechanism to determine the client IP address has been rewritten. The correct IP address determination now requires to set the Parse Server option `trustProxy`.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| parse-community | parse-server | < 5.4.1 | 5.4.1 |
| parse-community | parse-server | >= 0 < 5.4.1 | 5.4.1 |
| parseplatform | parse-server | < 5.4.1 | 5.4.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Parse Server option `masterKeyIps` vulnerability to IP spoofing
ghsa·2023-01-31
CVE-2023-22474 [HIGH] CWE-290 Parse Server option `masterKeyIps` vulnerability to IP spoofing
Parse Server option `masterKeyIps` vulnerability to IP spoofing
### Impact
Parse Server uses the request header `x-forwarded-for` to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various features in Parse Server. This allows to circumvent the security mechanism of the Parse Server option `masterKeyIps` by setting an allowed IP address as the `x-forwarded-for` header value.
### Patches
The mechanism to determine the client IP address has been rewritten. The correct IP address determination now requires to set the Parse Server option `trustProxy` accordingly, see the express framework's [trust proxy](https://expressjs
OSV
Parse Server option `masterKeyIps` vulnerability to IP spoofing
osv·2023-01-31
CVE-2023-22474 [HIGH] Parse Server option `masterKeyIps` vulnerability to IP spoofing
Parse Server option `masterKeyIps` vulnerability to IP spoofing
### Impact
Parse Server uses the request header `x-forwarded-for` to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various features in Parse Server. This allows to circumvent the security mechanism of the Parse Server option `masterKeyIps` by setting an allowed IP address as the `x-forwarded-for` header value.
### Patches
The mechanism to determine the client IP address has been rewritten. The correct IP address determination now requires to set the Parse Server option `trustProxy` accordingly, see the express framework's [trust proxy](https://expressjs
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/parse-community/parse-server/commit/e016d813e083ce6828f9abce245d15b681a224d8https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6xhttps://github.com/parse-community/parse-server/commit/e016d813e083ce6828f9abce245d15b681a224d8https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6xhttps://security.netapp.com/advisory/ntap-20230309-0005/
2023-02-03
Published