Parse Server DoS via file pointer without URL (GHSA-gpr6-gr9g-pfw6)

Vulnerability Overview Vulnerability Name: Server crash via file pointer without URL in an object write Vulnerability Description: An attacker can cause the Parse Server process to crash by saving an object containing a file reference without a URL. This affects any class that has Cloud Code save, find, or delete triggers enabled and has LiveQuery enabled. Authentication is not required, even if no user is logged in. File references without URLs nested within objects or arrays can also be stored; subsequently, requests running triggers or LiveQuery will terminate after the object failure. Affected Scope Affected Versions: - (npm) >= 9.0.0, < 9.10.2-alpha.3 - < 8.6.95 Fixed Versions: - (npm) 9.10.2-alpha.3 - 8.6.95 Remediation Patch: - File references without URLs are now resolved before being passed to Cloud Code triggers and LiveQuery, including file references nested in objects and arrays, as well as file references set by triggers. File references nested in query responses are also now resolved. File references with missing or invalid names are rejected. Errors in LiveQuery notifications are now caught and logged instead of terminating the process. Workaround: - Add a middleware before Parse Server to reject write requests for objects whose body contains set to and does not have a or where is not a string. Note that this also rejects legitimate requests referencing existing file names. References GitHub Security Advisory: GHSA-gpr6-gr9g-pfw6 Fix for Parse Server 9: #10694 Fix for Parse Server 8: #10695 Additional Information Severity: 8.2 / 10 CVSS v3 Base Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Impact Metrics: - Confidentiality: None - Integrity: None - Availability: High - Subsequent Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None Credit Coordinator: mtreza

Goal Reached Thanks to every supporter — we hit 100%!

Parse Server DoS via file pointer without URL (GHSA-gpr6-gr9g-pfw6)

More from this source