Parse Server Pre-Auth DoS via Regex Backtracking (CVE-2024-47138) Advisory

Vulnerability Overview Vulnerability Name: Pre-authentication denial of service via client version header regex backtracking Vulnerability ID: GHSA-38m6-82c8-4x4m Severity: High (8.7/10) CVSS v4 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: None - Privileges Required: None - User Interaction: None - System Impacts: - Confidentiality: None - Integrity: None - Availability: High - Subsequent System Impacts: - Confidentiality: None - Integrity: None - Availability: None Affected Scope Affected Versions: - (npm): >= 9.0.0, < 9.9.1-alpha.1, < 8.7.7 Impact Description: - An unauthenticated attacker can trigger regex backtracking by sending an HTTP request containing malicious input, causing the server's CPU resources to be exhausted and resulting in a denial of service (DoS). - This vulnerability occurs when parsing the field in request headers, prior to authentication. - Attackers can saturate worker processes by sending a large number of concurrent requests or a single large request, affecting default configurations in production deployments. Remediation Patch Versions: - (npm): 9.9.1-alpha.1, 8.7.7 Patch Details: - Removed client SDK version capturing and parsing. - Removed handling of the parameter and the header. - Requests from Parse SDKs are no longer affected. Temporary Workarounds: - Deploy a reverse proxy or WAF in front of Parse Server to strip or strictly restrict the header and field. - Header size limiting alone is insufficient, as body-field variants require inspection of JSON content. - Upgrading to the patched version is the recommended remediation method. References GitHub Security Advisory Fix Parse Server 9 Fix Parse Server 8 Additional Information CVE ID: CVE-2024-47138 CWE: CWE-133 Reporter: shmulc Coordinator: mtrizza

Goal Reached Thanks to every supporter — we hit 100%!

Parse Server Pre-Auth DoS via Regex Backtracking (CVE-2024-47138) Advisory

More from this source