Musard Balliu

**Name of the Vulnerable Software and Affected Versions** Parse Server versions prior to 5.3.3 Parse Server versions prior to 4.10.20 **Description** A compromised Parse Server Cloud Code Webhook target endpoint allows an attacker to use prototype pollution to bypass the Parse Server `requestKeywordDenylist` option. This issue affects Parse Server, an open source backend that can be deployed to any infrastructure that can run Node.js. **Recommendations** For versions prior to 5.3.3, update to version 5.3.3 or later. For versions prior to 4.10.20, update to version 4.10.20 or later. As a temporary workaround, consider restricting access to the Cloud Code Webhook target endpoint until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Parse Server versions prior to 4.10.19 Parse Server versions prior to 5.3.2 **Description** The issue allows keywords specified in the `requestKeywordDenylist` option to be injected via Cloud Code Webhooks or Triggers, resulting in the keyword being saved to the database and bypassing the `requestKeywordDenylist` option. This can be exploited by making requests to the Cloud Code Webhooks API. To mitigate this, configuring the firewall to only allow trusted servers to make requests to the Parse Server Cloud Code Webhooks API or blocking the API completely if not in use can help. **Recommendations** For versions prior to 4.10.19, update to version 4.10.19 or later. For versions prior to 5.3.2, update to version 5.3.2 or later. As a temporary workaround, consider configuring your firewall to only allow trusted servers to make requests to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature.

**Name of the Vulnerable Software and Affected Versions** Parse Server versions prior to 4.10.18 Parse Server versions prior to 5.3.1 on the 5.X branch **Description** Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. An attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. This issue is patched in version 5.3.1 and in 4.10.18. **Recommendations** For versions prior to 4.10.18, update to version 4.10.18 or later. For versions prior to 5.3.1 on the 5.X branch, update to version 5.3.1 or later. As a temporary workaround, consider disabling remote code execution through the MongoDB BSON parser until a patch is available.