Executive brief
Parse Server, a popular open-source backend for Node.js applications, is vulnerable to a denial-of-service attack. An attacker can send a specific request to certain internal data categories that causes the server to crash or return errors for all subsequent requests. This effectively takes the application offline, preventing legitimate users from accessing services or data.
Technical details
Parse Server versions prior to 3.4.1 contain a vulnerability where a POST request directed at volatile classes (e.g., /parse/classes/_Audience) causes the server to enter a state where all subsequent POST requests fail with an Internal Server Error (500). The root cause is related to inconsistent interpretation or handling of these specific class requests, which may persist in the underlying database. An unauthenticated remote attacker can exploit this to permanently disable the server's ability to process new data until manual intervention occurs. Remediation requires upgrading to version 3.4.1 and manually removing the offending collections from the database.
Affected products
- Parse Platform Parse Server < 3.4.1
Timeline
- 2019-06-12: disclosed: Initial advisory published by maintainers
- 2019-06-13: advisory: GitHub Advisory published
- 2019-07-29: advisory: NVD publication date