Executive brief
Parse Server is a backend application platform that handles data storage and file uploads for mobile and web applications. When a user uploads a file without an extension, the server crashes and becomes unavailable. This can be exploited by an attacker to cause a denial of service, disrupting the application and its users.
Technical details
This vulnerability is a denial-of-service flaw triggered when Parse Server processes a file upload lacking an extension. The crash occurs due to improper handling of file path operations (CWE-22, CWE-23) when the code attempts to extract or validate the file extension. The attack requires only network access with no authentication or user interaction required. An unauthenticated attacker can repeatedly upload files without extensions to crash the server, rendering it unavailable. Patches were released in version 5.5.6 (LTS branch) and 6.3.1 (main branch).
Affected products
- Parse Community Parse Server 1.0.0 to <5.5.6 and 6.0.0 to <6.3.1
Timeline
- 2023-10-20: disclosed
- 2023-10-24: patched: Parse Server 5.5.6 and 6.3.1 released