Executive brief
Parse Server is a backend service used to manage application data and authentication. When configured with PostgreSQL, a SQL injection vulnerability in the literalizeRegexPart function allows an unauthenticated attacker to bypass authentication and gain unauthorized access to sensitive data, modify records, or disrupt service availability without requiring any user interaction.
Technical details
This is a SQL injection vulnerability (CWE-288) in the literalizeRegexPart function of Parse Server when using PostgreSQL as the database backend. The vulnerability allows unauthenticated remote attackers to inject arbitrary SQL through crafted input, enabling authentication bypass and full database access (confidentiality, integrity, and availability impact). The attack requires no special privileges, user interaction, or complex conditions—a remote attacker can directly exploit the flaw over the network. Patches are available in Parse Server 6.5.7 and 7.1.0 through pull requests #9167 and #9168.
Affected products
- Parse Community Parse Server <6.5.7 and >=7.0.0 <7.1.0
Timeline
- 2024-07-01: disclosed
- 2024-07-01: patched: Parse Server 6.5.7 and 7.1.0 released