Executive brief
Parse Server is a backend framework used to power mobile and web applications with data storage and query capabilities. A flaw in the Query Pointer mechanism allows unauthenticated attackers to bypass query security triggers and access internal server classes that should be restricted, potentially exposing sensitive data or allowing unauthorized data retrieval.
Technical details
The vulnerability exists in Parse Server's internal query pipeline when processing Parse Pointers—references to objects in the database. The `beforeFind` trigger, a security hook that filters or modifies queries before execution, is not invoked when a Parse Pointer is used to fetch related objects internally. This allows attackers to circumvent access controls that rely on this trigger and gain direct access to internal Parse Server classes. The flaw affects Parse Server versions 1.0.0 through 5.5.4 and 6.0.0 through 6.2.1; patches are available in versions 5.5.5 and 6.2.2. The vulnerability requires only network access with no authentication or user interaction, resulting in high-impact confidentiality breaches.
Affected products
- Parse Community Parse Server 1.0.0 to 5.5.4 and 6.0.0 to 6.2.1
Timeline
- 2023-09-04: disclosed
- 2023-09-04: patched: Patched in Parse Server 5.5.5 and 6.2.2