Parse Server Transactional Batch Request Blocks/Rolls Back Other Clients' Writes (GHSA-jh99-hrgh-c9gv)

Vulnerability Overview Vulnerability Name: Transactional batch request can roll back or block writes of other clients Vulnerability ID: GHSA-jh99-hrgh-c9gv Severity: High (CVSS v4 base metrics: 8.3 / 10) Publication Date: 2 weeks ago Publisher: mitreza Affected Versions Affected Versions: - (npm): - >= 9.0.0, = 5.4.0, < 8.6.96 Impact Description: - Transactional batch requests may interfere with database write operations of other clients, causing these writes to be rolled back or blocked. - In PostgreSQL, MongoDB replica sets, or MongoDB sharded clusters, these write operations become part of the batch transaction; if the batch fails, these writes are rolled back. - In PostgreSQL, requests may keep database transactions open indefinitely, causing subsequent write requests to fail. - In MongoDB, requests may keep database transactions open indefinitely, causing subsequent write requests to fail. - Impacts applications that have set the to a function, registered Cloud Code validators, and configured . Remediation Patch Versions: - (npm): - 9.10.2-alpha.5 - 8.6.96 Patch Description: - Each request now uses its own database controller, which holds the state for transactional batches. Loading the master key no longer writes request-scoped configuration to the server-scoped configuration cache, and transactions cannot be initiated on the same database controller as another active transaction. Workaround: - Set the to a string instead of a function, and do not register Cloud Code validators with after the server starts. References GitHub Security Advisory: GHSA-jh99-hrgh-c9gv Fix Parse Server 9: #10713 Fix Parse Server 8: #10716 Additional Information CVSS v4 Base Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: Present - Privileges Required: None - User Interaction: None - Vulnerable System Impact Metrics: - Confidentiality: None - Integrity: Low - Availability: High - Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None CVE ID: No known CVE Weaknesses: CWE-362 Credits: mitreza (Coordinator)

Goal Reached Thanks to every supporter — we hit 100%!

Parse Server Transactional Batch Request Blocks/Rolls Back Other Clients' Writes (GHSA-jh99-hrgh-c9gv)

More from this source