-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| parse | npm | < 7.0.0 | 7.0.0 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability is a classic prototype pollution issue in the Parse Javascript SDK. The root cause is the improper handling of object keys in several parts of the codebase, which allowed an attacker to modify the Object.prototype by using malicious keys like __proto__, constructor, or prototype.
The analysis of the patch commit 00973987f361368659c0c4dbf669f3897520b132 reveals that the fix involves two main strategies:
isDangerousKey to explicitly check for and block malicious keys.{} to Object.create(null) to prevent access to the Object.prototype.The vulnerable functions were identified by locating where these fixes were applied. The core of the vulnerability lies in the internal decode, encode, and ObjectStateMutations modules, which were responsible for handling object data without proper validation. These internal vulnerabilities were then exposed through the public API of ParseObject, specifically in functions like fromJSON, registerSubclass, and pin, as stated in the security advisory.
The identified functions are the ones that would appear in a runtime profile when the vulnerability is triggered. An attacker would craft a malicious object and pass it to one of these functions, causing the prototype pollution to occur within the execution of that function.
decodesrc/decode.ts
encodesrc/encode.ts
setServerDatasrc/ObjectStateMutations.ts
setPendingOpsrc/ObjectStateMutations.ts
mergeFirstPendingStatesrc/ObjectStateMutations.ts
estimateAttributesrc/ObjectStateMutations.ts
estimateAttributessrc/ObjectStateMutations.ts
commitServerChangessrc/ObjectStateMutations.ts
ParseObject.registerSubclasssrc/ParseObject.ts
ParseObject.fromJSONsrc/ParseObject.ts
ParseObject.pinsrc/ParseObject.ts
Ongoing coverage of React2Shell