CVE-2021-39187— Crash server with query parameter

Quick assessment

Copy summary Copy citation

Affected

parse-community parse-server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Parse Server是一个开源后端，可以部署到任何可以运行 Node.js 的基础设施。 Parse Server 4.10.3之前版本存在注入漏洞，如果查询请求包含“explain”选项的无效值，则解析服务器会崩溃。该漏洞源于MongoDB Node.js驱动程序中存在的一个错误，该错误引发了解析服务器无法捕获的异常。4.10.3版本中有针对此问题的修补程序。除了升级之外，目前还没有其他解决办法

CVE-2021-39187 affects parse-community parse-server. No confirmed in-the-wild exploitation; assess based on exposure. Parse Server是一个开源后端，可以部署到任何可以运行 Node.js 的基础设施。 Parse Server 4.10.3之前版本存在注入漏洞，如果查询请求包含“explain”选项的无效值，则解析服务器会崩溃。该漏洞源于MongoDB Node.js驱动程序中存在的一个错误，该错误引发了解析服务器无法捕获的异常。4.10.3版本中有针对此问题的修 CVE-2021-39187 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2021-39187

I. Basic Information for CVE-2021-39187

Affected Products

II. Public POCs for CVE-2021-39187

III. Intelligence Information for CVE-2021-39187

Patches & Fixes for CVE-2021-39187 (1)

• https://github.com/parse-community/parse-server/commit/308668c89474223e2448be92d6823b52c1c313ec x_refsource_MISC

Vendor Advisories for CVE-2021-39187 (1)

• https://github.com/parse-community/parse-server/security/advisories/GHSA-xqp8-w826-hh6x x_refsource_CONFIRM

Other References for CVE-2021-39187 (2)

• https://github.com/parse-community/parse-server/releases/tag/4.10.3 x_refsource_MISC
• https://jira.mongodb.org/browse/NODE-3463 x_refsource_MISC

• https://www.cve.org/CVERecord?id=CVE-2021-39187

IV. Related Vulnerabilities