CVE-2022-24760

CVE-2022-24760 flow 기본적으로 db에 클래스를 추가/삭제/수정할 때 key가 필요하지 않음 Diff commit https://github.com/parse-community/parse-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d Prototype pollution은 expandResultOnKeyPath 함수에서 발생 root@kitploit: DatabaseController.js sanitizeDatabaseResult -...