Executive brief
Parse Server Push Adapter is a library that handles sending push notifications to mobile devices. An attacker with administrative privileges can send a specially crafted push notification request that crashes the Parse Server, disrupting notification delivery and potentially affecting service availability.
Technical details
The Parse Server Push Adapter is vulnerable to an improper input validation issue (CWE-20) where invalid push notification payloads are not properly validated before processing, causing the server to crash. The vulnerability requires high privileges (administrative access) to exploit and is accessed over the network. The attack does not require user interaction. An attacker can trigger a denial-of-service condition by sending a malformed push request payload. The vulnerability was patched in version 4.1.3 where invalid push notification payloads are now caught and logged instead of crashing the server.
Affected products
- Parse Community Parse Server Push Adapter before 4.1.3
Timeline
- 2023-05-22: disclosed
- 2023-05-22: patched: Version 4.1.3 released