Executive brief
Parse Server is a backend-as-a-service platform that handles file uploads and requests. Certain malformed file requests can crash the server, disrupting service availability. In single-instance deployments, this can cause complete outage until the server is restarted; in clustered deployments, the impact is mitigated by failover to other instances.
Technical details
A denial-of-service vulnerability exists in Parse Server's file request handling due to improper validation of file requests (CWE-252: Unchecked Error Condition). Certain types of invalid file requests are not properly handled, causing the server process to crash. The vulnerability requires no authentication or user interaction and is exploitable over the network. An attacker can trigger a server crash by sending specially crafted invalid file requests, resulting in service unavailability. The vulnerability has been patched in versions 4.10.12 and 5.2.3; affected versions are all versions before 4.10.12 and versions 5.0.0 through 5.2.2.
Affected products
- Parse Community Parse Server <4.10.12, >=5.0.0 <5.2.3
Timeline
- 2022-06-17: disclosed
- 2022-06-20: patched