Parse Server GraphQL Schema Disclosure via Persisted Queries Fix

Vulnerability Overview Vulnerability Name: GraphQL schema is disclosed by replaying an automatic persisted query when public introspection is disabled CVE ID: No known CVE CVSS Score: 6.3 / 10 Severity: Medium Affected Versions Affected Versions: - parse-server >= 9.0.0, = 8.2.2, < 8.6.94 Impact Description: - Parse Server can return the full GraphQL schema without authentication, even when public introspection is disabled. - Attackers can retrieve the schema, including class names and field names that should be protected, by replaying automatic persisted queries. - This only affects deployments where the GraphQL API is mounted; it is not mounted by default. - It does not expose user data; class-level and object-level permissions continue to protect all data access. - Exploitation depends on a client registering automatic persisted queries using the master key or maintenance key. Remediation Patch: - Introspection controls now read the operation text parsed by Apollo Server for each request, including those from the automatic persisted query cache. - If the operation text of a request cannot be inspected, the request is rejected instead of being allowed. - The same fix has been applied to controls that remove schema identifiers from GraphQL error messages. Workaround: - Deployments that do not require the GraphQL API can keep it unmounted (default state). - If the API is required, ensure that clients authenticated with the master key or maintenance key do not use automatic persisted queries. - For Parse Server 8 and versions prior to 9.3.1, setting to activates Apollo Server's introspection controls. References GitHub Security Advisory Fix Parse Server 9: #10669 Fix Parse Server 8: #10670 Additional Information Reporter: mtrezza Publication Date: 3 weeks ago Credits: mtrezza

Goal Reached Thanks to every supporter — we hit 100%!

Parse Server GraphQL Schema Disclosure via Persisted Queries Fix

More from this source