Login Request a demo
Critical severity · published Mar 19, 2024
CVE-2024-29027
Parse Server crash and RCE via invalid Cloud Function or Cloud Job name
9.0
CVSS
1.2%
EPSS
No
On KEV
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal store manipulation or remote code execution. The patch in versions 6.5.5 and 7.0.0-alpha.29 added string sanitation for Cloud Function name and Cloud Job name. As a workaround, sanitize the Cloud Function name and Cloud Job name before it reaches Parse Server.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
parse-server · parse-community
< 6.5.5; >= 7.0.0-alpha.1, < 7.0.0-alpha.29 · source: vendor, NVD
PS
Parse Server · Parse Community
before 6.5.5; 7.0.0-alpha.1 before 7.0.0-alpha.29 · source: CISA
Affected product
PA
parse-server
parse-community
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-29027
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-29027
Patch
https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b
Patch
https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e
Release Notes
https://github.com/parse-community/parse-server/releases/tag/6.5.5
Release Notes
https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29
Vendor Advisory
https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29
More from parse-server
10.0
CVE-2026-30966
Parse Server role escalation and CLP bypass via direct `_Join` table write
10.0
CVE-2024-27298
Parse Server literalizeRegexPart SQL Injection
9.8
CVE-2026-32248
Parse Server: Account takeover via operator injection in authentication data identifier
9.8
CVE-2026-31871
Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
9.8
CVE-2026-31856
Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL