Executive brief
Parse Server is a popular open-source backend framework that handles cloud functions and scheduled jobs for mobile and web applications. An attacker can crash the server and potentially execute arbitrary code by submitting specially crafted requests with invalid Cloud Function or Cloud Job names, leading to service unavailability and potential data compromise.
Technical details
The vulnerability stems from insufficient input validation on Cloud Function and Cloud Job names in Parse Server. When an invalid name is provided, the server fails to properly sanitize the input before processing, allowing code injection and causing an unhandled exception that crashes the server. The flaw affects all versions prior to 6.5.5 (LTS) and 7.0.0-alpha.29 (development branch). An attacker can exploit this over the network without authentication or user interaction by sending crafted requests with malicious function or job names. The fix involves adding string sanitation for both Cloud Function and Cloud Job name inputs.
Affected products
- Parse Community Parse Server All versions prior to 6.5.5; 7.0.0-alpha.1 through 7.0.0-alpha.28
Timeline
- 2024-03-19: disclosed
- 2024-03-19: patched: Parse Server 6.5.5 (LTS) and 7.0.0-alpha.29 released