Executive Summary

This vulnerability involves Parse Server versions before 4.10.0, where a supply chain incident occurred. Incorrect version tags were pushed to the official repository, pointing to an unreviewed personal fork of a contributor who had write access. Although no releases were published with these tags, a project could be exposed if it defined a git-based dependency referencing one of the affected tags (e.g., parse-server#4.9.3). The code behind these tags was not reviewed or approved, and while no malicious code was found, the possibility of introduced security vulnerabilities could not be ruled out.

Useful 0 Not Useful 0

Impact Analysis

If your project uses a git-based dependency referencing one of the affected incorrect version tags, it could be exposed to unreviewed code that might contain security vulnerabilities. This could lead to potential security risks such as unauthorized access, data compromise, or other impacts depending on the nature of the unreviewed code. However, no malicious code was identified in this incident.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects Parse Server versions before 4.10.0 that define a git-based dependency referencing one of the affected incorrect version tags (e.g., parse-server#4.9.3). Detection involves checking if your project dependencies include such git-based references to these tags.

You can inspect your project's dependency files (such as package.json or package-lock.json) for git-based dependencies pointing to parse-server versions with tags like 4.9.3.

Example commands to detect this might include:

• grep -r 'parse-server#4.9.3' ./
• grep -r 'git+' ./
• npm ls parse-server

These commands help identify if your project or its dependencies reference the affected tags or git-based dependencies that could be vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately avoid using any git-based dependencies referencing the affected incorrect version tags of Parse Server (e.g., parse-server#4.9.3).

Upgrade your Parse Server dependency to version 4.10.0 or later, where this issue has been resolved.

Review your dependency definitions to ensure no unreviewed or personal forks are referenced.

Useful 0 Not Useful 0