TI-2023-08723 Aliases CVE-2023-22474 GHSA-vm5r-c87r-pf6x

Parse Server is vulnerable to authentication bypass via spoofing

MEDIUM 41CWE-290Published 2023-02-03 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-290.

Summary

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for` to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various features in Parse Server. This allows to circumvent the security mechanism of the Parse Server option `masterKeyIps` by setting an allowed IP address as the `x-forwarded-for` header value. This issue has been patched in version 5.4.1. The mechanism to determine the client IP address has been rewritten. The correct IP address determination now requires to set the Parse Server option `trustProxy`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00664 51st percentileScored 2026-11-07

Fix Fixed parse-server (parse-community): 5.4.1parse-server (npm): 5.4.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
parse-community	parse-server	before 5.4.1	5.4.1	Patch available	CNA
—	parse-server (npm)	before 5.4.1	5.4.1	Patch available	GHSA-vm5r-c87r-pf6x

parse-server Vendorparse-community Affected before 5.4.1 Fixed in 5.4.1 Patch available CNA
parse-server (npm) Vendor— Affected before 5.4.1 Fixed in 5.4.1 Patch available GHSA-vm5r-c87r-pf6x

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:parseplatform:parse-server::::::node.js::*	before 5.4.1	Vulnerable	parse-community

cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* Versions before 5.4.1 Vulnerable ·parse-community

Remediation

Fix · CNA parse-server (parse-community) Fixed in 5.4.1
Fix · GHSA-vm5r-c87r-pf6x parse-server (npm) Fixed in 5.4.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-22474
2026-10-03 Alias added: GHSA-vm5r-c87r-pf6x
2026-10-06 EPSS moved to the 50th–90th percentile

References

Patch 1

https://github.com/parse-community/parse-server/commit/e016d813e083ce6828f9abce245d15b681a224d8

Advisory 2

Other 1

https://github.com/parse-community/parse-server

TI-2022-08574 Command Injection in Parse server CVSS 3.1CRITICAL 10.0
TI-2024-18136 Parse Server literalizeRegexPart SQL Injection CVSS 3.1CRITICAL 10.0
TI-2022-18768 Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser CVSS 3.1CRITICAL 9.8
TI-2024-31550 Parse Server's custom object ID allows to acquire role privileges CVSS 3.1HIGH 8.1
TI-2023-18316 Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution CVSS 3.1CRITICAL 9.8
TI-2026-23790 Parse Server session token exfiltration via `redirectClassNameForKey` query parameter CVSS 4.0CRITICAL 9.9

See all 101 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences