CVE-2024-39309
published 2024-07-01CVE-2024-39309: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0…
PriorityP276critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
20.17%
97.1th percentile
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to detect SQL injection has been improved in versions 6.5.7 and 7.1.0. No known workarounds are available.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| parse-community | parse-server | < 6.5.7 | 6.5.7 |
| parse-community | parse-server | — | — |
| parse-community | parse-server | >= 0 < 6.5.7 | 6.5.7 |
| parse-community | parse-server | >= 7.0.0 < 7.1.0 | 7.1.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
ghsa·2024-07-01
CVE-2024-39309 [CRITICAL] CWE-288 ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
### Impact
This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database.
### Patches
The algorithm to detect SQL injection has been improved.
### Workarounds
None.
### References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r
- https://github.com/parse-community/parse-server/pull/9167 (fix for Parse Server 7)
- https://github.com/parse-community/parse-server/pull/9168 (fix for Parse Server 6)
### Credits
- Smile Thanapattheerakul of Trend Micro (finder)
- Manuel Trezza (coordinator)
OSV
ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
osv·2024-07-01
CVE-2024-39309 [CRITICAL] ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
### Impact
This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database.
### Patches
The algorithm to detect SQL injection has been improved.
### Workarounds
None.
### References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r
- https://github.com/parse-community/parse-server/pull/9167 (fix for Parse Server 7)
- https://github.com/parse-community/parse-server/pull/9168 (fix for Parse Server 6)
### Credits
- Smile Thanapattheerakul of Trend Micro (finder)
- Manuel Trezza (coordinator)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/parse-community/parse-server/commit/2edf1e4c0363af01e97a7fbc97694f851b7d1ff3https://github.com/parse-community/parse-server/commit/f332d54577608c5ad927255e06d8c694e2e0ff5bhttps://github.com/parse-community/parse-server/pull/9167https://github.com/parse-community/parse-server/pull/9168https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6rhttps://github.com/parse-community/parse-server/commit/2edf1e4c0363af01e97a7fbc97694f851b7d1ff3https://github.com/parse-community/parse-server/commit/f332d54577608c5ad927255e06d8c694e2e0ff5bhttps://github.com/parse-community/parse-server/pull/9167https://github.com/parse-community/parse-server/pull/9168https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r
2024-07-01
Published