Executive brief
Parse Server is a backend platform that handles file storage and downloads for applications. An attacker can crash the server by sending a file download request with an invalid byte range, causing service outages and disrupting application availability.
Technical details
The vulnerability exists in Parse Server's HTTP range request handling, where improper parsing of the Range header parameter allows an attacker to send a crafted byte range request that causes the server to crash. No authentication or user interaction is required—the attack is triggered by a simple malformed network request. The root cause is insufficient input validation on the Range header (CWE-20) and improper handling of invalid enumerated values (CWE-1284). An attacker with network access can remotely trigger a denial of service condition. The patch improves validation of the range parameter to safely reject invalid range requests. Fixes are available in versions 4.10.17+ and 5.2.8+.
Affected products
- Parse Community Parse Server <4.10.17, >=5.0.0 <5.2.8
Timeline
- 2022-10-18: disclosed
- 2022-10-18: patched: Versions 4.10.17+ and 5.2.8+ released