gsd-2023-22474
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for` to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various features in Parse Server. This allows to circumvent the security mechanism of the Parse Server option `masterKeyIps` by setting an allowed IP address as the `x-forwarded-for` header value. This issue has been patched in version 5.4.1. The mechanism to determine the client IP address has been rewritten. The correct IP address determination now requires to set the Parse Server option `trustProxy`.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2023-22474",
"id": "GSD-2023-22474"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2023-22474"
],
"details": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for` to determine the client IP address. If Parse Server doesn\u0027t run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various features in Parse Server. This allows to circumvent the security mechanism of the Parse Server option `masterKeyIps` by setting an allowed IP address as the `x-forwarded-for` header value. This issue has been patched in version 5.4.1. The mechanism to determine the client IP address has been rewritten. The correct IP address determination now requires to set the Parse Server option `trustProxy`.",
"id": "GSD-2023-22474",
"modified": "2023-12-13T01:20:42.698482Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2023-22474",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "parse-server",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "\u003c 5.4.1"
}
]
}
}
]
},
"vendor_name": "parse-community"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for` to determine the client IP address. If Parse Server doesn\u0027t run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various features in Parse Server. This allows to circumvent the security mechanism of the Parse Server option `masterKeyIps` by setting an allowed IP address as the `x-forwarded-for` header value. This issue has been patched in version 5.4.1. The mechanism to determine the client IP address has been rewritten. The correct IP address determination now requires to set the Parse Server option `trustProxy`."
}
]
},
"impact": {
"cvss": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"cweId": "CWE-290",
"lang": "eng",
"value": "CWE-290: Authentication Bypass by Spoofing"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6x",
"refsource": "MISC",
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6x"
},
{
"name": "https://github.com/parse-community/parse-server/commit/e016d813e083ce6828f9abce245d15b681a224d8",
"refsource": "MISC",
"url": "https://github.com/parse-community/parse-server/commit/e016d813e083ce6828f9abce245d15b681a224d8"
}
]
},
"source": {
"advisory": "GHSA-vm5r-c87r-pf6x",
"discovery": "UNKNOWN"
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003c5.4.1",
"affected_versions": "All versions before 5.4.1",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-290",
"CWE-937"
],
"date": "2023-02-10",
"description": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for` to determine the client IP address. If Parse Server does not run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various features in Parse Server. This allows to circumvent the security mechanism of the Parse Server option `masterKeyIps` by setting an allowed IP address as the `x-forwarded-for` header value. This issue has been patched in version 5.4.1. The mechanism to determine the client IP address has been rewritten. The correct IP address determination now requires to set the Parse Server option `trustProxy`.",
"fixed_versions": [
"5.4.1"
],
"identifier": "CVE-2023-22474",
"identifiers": [
"CVE-2023-22474",
"GHSA-vm5r-c87r-pf6x",
"GMS-2023-196"
],
"not_impacted": "All versions starting from 5.4.1",
"package_slug": "npm/parse-server",
"pubdate": "2023-02-03",
"solution": "Upgrade to version 5.4.1 or above.",
"title": "Authentication Bypass by Spoofing",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2023-22474",
"https://github.com/parse-community/parse-server/commit/e016d813e083ce6828f9abce245d15b681a224d8",
"https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6x",
"https://github.com/advisories/GHSA-vm5r-c87r-pf6x"
],
"uuid": "d5e62d43-e632-416d-bb3a-06a4d1371bf0"
},
{
"affected_range": "\u003c0",
"affected_versions": "All versions before 5.4.1",
"cwe_ids": [
"CWE-1035",
"CWE-937"
],
"date": "2023-01-31",
"description": "### Impact\n\nParse Server uses the request header `x-forwarded-for` to determine the client IP address. If Parse Server does not run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various features in Parse Server. This allows to circumvent the security mechanism of the Parse Server option `masterKeyIps` by setting an allowed IP address as the `x-forwarded-for` header value.\n\n### Patches\n\nThe mechanism to determine the client IP address has been rewritten. The correct IP address determination now requires to set the Parse Server option `trustProxy` accordingly, see the express framework\u0027s [trust proxy](https://expressjs.com/en/guide/behind-proxies.html) setting.\n\n### References\n- https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6x\n- https://expressjs.com/en/guide/behind-proxies.html",
"fixed_versions": [
"5.4.1"
],
"identifier": "GMS-2023-196",
"identifiers": [
"GHSA-vm5r-c87r-pf6x",
"GMS-2023-196",
"CVE-2023-22474"
],
"not_impacted": "All versions starting from 5.4.1",
"package_slug": "npm/parse-server",
"pubdate": "2023-01-31",
"solution": "Upgrade to version 5.4.1 or above.",
"title": "Duplicate of ./npm/parse-server/CVE-2023-22474.yml",
"urls": [
"https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6x",
"https://github.com/advisories/GHSA-vm5r-c87r-pf6x"
],
"uuid": "43fe4295-cf20-4612-8135-6cbcc2e088b5"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
"cpe_name": [],
"versionEndExcluding": "5.4.1",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2023-22474"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for` to determine the client IP address. If Parse Server doesn\u0027t run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various features in Parse Server. This allows to circumvent the security mechanism of the Parse Server option `masterKeyIps` by setting an allowed IP address as the `x-forwarded-for` header value. This issue has been patched in version 5.4.1. The mechanism to determine the client IP address has been rewritten. The correct IP address determination now requires to set the Parse Server option `trustProxy`."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-290"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/parse-community/parse-server/commit/e016d813e083ce6828f9abce245d15b681a224d8",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/parse-community/parse-server/commit/e016d813e083ce6828f9abce245d15b681a224d8"
},
{
"name": "https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6x",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6x"
}
]
}
},
"impact": {
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2
}
},
"lastModifiedDate": "2023-02-10T17:32Z",
"publishedDate": "2023-02-03T20:15Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…