CVE-2024-29027— Parse Server crash and RCE via invalid Cloud Function or Cloud Job name

Quick assessment

Copy summary Copy citation

Affected

parse-community parse-server

Exploitation

Public or AI PoC available; prioritize validation

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Parse Server是一个开源后端，可以部署到任何可以运行 Node.js 的基础设施。 Parse Server 6.5.5、7.0.0-alpha.29 之前存在注入漏洞，该漏洞源于调用无效的 Parse Server Cloud Function 名称或 Cloud Job 名称会导致服务崩溃。

CVE-2024-29027 affects parse-community parse-server. Public or AI PoC available; prioritize validation. Parse Server是一个开源后端，可以部署到任何可以运行 Node.js 的基础设施。 Parse Server 6.5.5、7.0.0-alpha.29 之前存在注入漏洞，该漏洞源于调用无效的 Parse Server Cloud Function 名称或 Cloud Job 名称会导致服务崩溃。 CVE-2024-29027 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2024-29027

I. Basic Information for CVE-2024-29027

Affected Products

II. Public POCs for CVE-2024-29027

III. Intelligence Information for CVE-2024-29027

Patches & Fixes for CVE-2024-29027 (2)

• https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b x_refsource_MISC
• https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e x_refsource_MISC

Vendor Advisories for CVE-2024-29027 (1)

• https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29 x_refsource_CONFIRM

Other References for CVE-2024-29027 (2)

• https://github.com/parse-community/parse-server/releases/tag/6.5.5 x_refsource_MISC
• https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29 x_refsource_MISC

• https://www.cve.org/CVERecord?id=CVE-2024-29027

IV. Related Vulnerabilities