Junglewise Threat Intelligence

CVE-2022-36079: Parse Server sensitive data exposure via query constraint brute-force

CVE-2022-36079 · Severity: low · CVSS 3.1 · Published 2022-09-16

Technologies: Parse Platform Parse-Server.

Executive brief

Parse Server, a popular open-source backend for mobile and web applications, is vulnerable to a data exposure flaw. Attackers can use specially crafted search queries to guess sensitive internal or protected user data by observing the server's response patterns. If exploited, this could allow unauthorized access to private information that should only be visible to administrators.

Technical details

A vulnerability in Parse Server allows unauthenticated attackers to perform side-channel brute-force attacks against internal fields (prefixed with '_') and user-defined protected fields. While Parse Server correctly filters these fields from final query results unless a master key is used, it incorrectly allows them to be used as query constraints. By systematically enumerating possible values in a search query and observing whether the server returns a match, an attacker can reconstruct sensitive data. The fix, implemented in versions 4.10.14 and 5.2.5, restricts the use of internal and protected fields in query constraints to requests authenticated with the master key.

Affected products

  • Parse Platform parse-server < 4.10.14, >= 5.0.0 < 5.2.5

Timeline

  • 2022-09-02: patched: Fixes merged into release branches
  • 2022-09-07: disclosed: NVD publication date
  • 2022-09-16: advisory: GitHub Security Advisory published

References