Executive brief
Parse Server is a popular open-source backend service that manages data storage and queries for mobile and web applications. A vulnerability in its LiveQuery feature fails to remove sensitive "protected" fields before sending data to clients, allowing unauthorized access to confidential information that administrators intended to keep hidden.
Technical details
Parse Server's LiveQueryController fails to properly filter protected class fields when returning query results to clients. Protected fields are database columns marked by administrators as sensitive and not intended for client access. The vulnerability allows any client connected to LiveQuery to receive these protected fields in query responses without authentication checks or access controls. This is an information disclosure issue (CWE-200, CWE-212) exploitable over the network with no authentication required. Patches were released in versions 4.10.13 (for pre-5.0 branch) and 5.2.4 (for 5.0+ branch), implementing proper field filtering in LiveQueryController responses.
Affected products
- Parse Community Parse Server all versions before 4.10.13, and 5.0.0 before 5.2.4
Timeline
- 2022-06-30: disclosed
- 2022-07-06: advisory
- 2022-07-06: patched: Patches released in versions 4.10.13 and 5.2.4