Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-27298

CVE-2024-27298: ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection

10

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-27298
GHSA ID
GHSA-6927-3vr9-fxf2
EPSS Score
0.12148%
CWE
CWE-89
Published
3/1/2024
Updated
3/1/2024
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
parse-servernpm< 6.5.06.5.0
parse-servernpm>= 7.0.0-alpha.1, < 7.0.0-alpha.207.0.0-alpha.20

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the literalizeRegexPart function's handling of regex input sanitization. The commit diff shows the critical fix was adding the 'g' flag to .replace(/([^'])'/g, $1''), indicating the original implementation only replaced the first occurrence of unescaped single quotes. This incomplete escaping allowed SQL injection payloads like 'A'B';SELECT PG_SLEEP(3);--' to bypass sanitization. The added test case in vulnerabilities.spec.js explicitly validates this fix by testing a SQL injection attempt via $regex parameter, confirming the function's role in the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T*is vuln*r**ility *llows SQL inj**tion w**n P*rs* S*rv*r is *on*i*ur** to us* t** Post*r*SQL **t***s*. ### P*t***s T** *l*orit*m to **t**t SQL inj**tion **s ***n improv**. ### Work*roun*s Non*. ### R***r*n**s - *ttps://*it*u*.*om/p

Reasoning

T** vuln*r**ility st*ms *rom t** lit*r*liz*R***xP*rt *un*tion's **n*lin* o* r***x input s*nitiz*tion. T** *ommit *i** s*ows t** *riti**l *ix w*s ***in* t** '*' *l** to .r*pl***(/([^'])'/*, `$*''`), in*i**tin* t** ori*in*l impl*m*nt*tion only r*pl****