Vulnerability record · CVE-2022-24760 · published 12 March 2022
CVE-2022-24760: Parse Server prototype pollution leads to remote code execution
Parseplatform · Parse Server
Parse Server before 4.10.7 contains a prototype pollution flaw in DatabaseController.js that allows remote code execution. It affects the default MongoDB configuration and likely Postgres and other backends, and has been confirmed on Linux and Windows. Because the default configuration is vulnerable, any exposed Parse Server instance is at risk.
Description
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file `DatabaseController.js`, so it is likely to affect Postgres and any other database backend as well. This vulnerability has been confirmed on Linux (Ubuntu) and Windows. Users are advised to upgrade as soon as possible. The only known workaround is to manually patch your installation with code referenced at the source GHSA-p6h4-93qp-jhcm.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 10.0 with network reachability, no authentication, and public exploit references make this an urgent patch.
What it is
Parse Server before 4.10.7 contains a prototype pollution flaw in DatabaseController.js that allows remote code execution. It affects the default MongoDB configuration and likely Postgres and other backends, and has been confirmed on Linux and Windows. Because the default configuration is vulnerable, any exposed Parse Server instance is at risk.
Impact
An unauthenticated attacker can execute arbitrary code on the server, leading to full compromise of the host and any data it can reach.
Attack surface
The flaw is reachable over the network through the HTTP API with no authentication or user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any Parse Server instance running a vulnerable version with a supported database backend is exposed.
Exploitation
CISA KEV does not list this CVE, but EPSS is 0.49 (98.8th percentile) and multiple references are tagged Exploit, indicating public exploit code and elevated likelihood of exploitation.
What to do
- Upgrade Parse Server to 4.10.7 or later immediately.
- If upgrade is not possible, apply the manual patch referenced in GHSA-p6h4-93qp-jhcm.
- Restrict network access to the Parse Server API to trusted clients only.
- Audit database backends and configurations for exposure of the vulnerable endpoint.
- Monitor for unexpected process execution or outbound connections from the Parse Server host.
Detection
- Search server and application logs for anomalous requests to Parse Server API endpoints that may carry prototype pollution payloads.
- Monitor for unexpected child processes or command execution spawned by the Parse Server process.
- Alert on outbound network connections from the Parse Server host to unfamiliar destinations.
- Track Parse Server version inventory to identify instances below 4.10.7.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/parse-community/parse-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d | PatchThird Party Advisory |
| https://github.com/parse-community/parse-server/security/advisories/GHSA-p6h4-93qp-jhcm | ExploitMitigationThird Party Advisory |
| https://www.huntr.dev/bounties/ac24b343-e7da-4bc7-ab38-4f4f5cc9d099/ | ExploitPatchThird Party Advisory |
| https://github.com/parse-community/parse-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d | PatchThird Party Advisory |
| https://github.com/parse-community/parse-server/security/advisories/GHSA-p6h4-93qp-jhcm | ExploitMitigationThird Party Advisory |
| https://www.huntr.dev/bounties/ac24b343-e7da-4bc7-ab38-4f4f5cc9d099/ | ExploitPatchThird Party Advisory |
Track CVE-2022-24760 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-24760), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
