Parse Server GraphQL Schema Info Disclosure via Error Messages (GHSA-2g9g-4f6f-16rf)

Vulnerability Overview Vulnerability Name: GraphQL error messages disclose pointer and relation target class names when public introspection is disabled Vulnerability ID: GHSA-2g9g-4f6f-16rf Severity: Medium (6.3 / 10) CVSS v4 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: Present - Privileges Required: None - User Interaction: None - Confidentiality: Low - Integrity: None - Availability: None Affected Versions Affected Versions: - parse-server >= 9.0.0, = 8.2.2, < 8.8.87 Impact Description: - When the Parse Server GraphQL API is mounted and public schema introspection is disabled, unauthenticated clients can trigger GraphQL validation and input error messages using only the public application ID. These messages disclose target class names (Pointer and Relation fields). - These errors occur before authentication, authorization (CLP/ACL), or any resolvers. Attackers can reconstruct hidden schema class names by attempting non-existent field names, even without knowing the specific Pointer or Relation field names, thereby partially bypassing schema hiding protections. - Only schema metadata (class names) is exposed; object data, credentials, or user records are not exposed. Remediation Patch Versions: - parse-server 9.10.0-alpha.6 - parse-server 8.8.87 Patch Description: - The GraphQL error message sanitizer (introduced in GHSA-8cph-nqg4-gf5g, extended in GHSA-9gff-h8f3-h3cm, and GHSA-2gh-8g9w-w5sd) has been extended to remove schema type identifiers from additional GraphQL validation and coercion error templates. - This fix applies only to unauthenticated (non-admin, non-maintenance) callers when public introspection is disabled. It preserves any type names referenced by the caller in their operations, ensuring that legitimate validation feedback remains unaffected. References GitHub Security Advisory: GHSA-2g9g-4f6f-16rf Fix for Parse Server 9: #10568 Fix for Parse Server 8: #10569 Workarounds There are no workarounds that keep the GraphQL API available. Operators not using the GraphQL API can unmount it ( , which is the default value). Enabling does not mitigate the issue (as it intentionally exposes the schema). Upgrading to the patched version is required. Additional Information CVE ID: No known CVE Weakness: CWE-209 Credit: mitreza (Coordinator)

Goal Reached Thanks to every supporter — we hit 100%!

Parse Server GraphQL Schema Info Disclosure via Error Messages (GHSA-2g9g-4f6f-16rf)

More from this source