Executive brief
Parse Server is a Node.js backend framework used to power mobile and web applications with server-side data storage and file management. A vulnerability in its file upload feature allows an attacker to trigger requests to arbitrary URIs on the server, potentially targeting internal services or sensitive endpoints. While the feature has never worked reliably and crashes the server, the underlying SSRF vulnerability enables network-level attacks against internal infrastructure.
Technical details
The vulnerability is a Server-Side Request Forgery (CWE-918) in Parse Server's file upload functionality. The vulnerable feature, introduced in version 4.2.0, accepts a URI parameter when uploading a Parse.File and attempts to retrieve file data from that URI without proper validation. An unauthenticated attacker with network access can provide an arbitrary URI in the file upload request; the server will execute a request to that URI before crashing. Although the response is not stored due to a bug in the implementation, the attacker can still probe internal network endpoints, access services on localhost, or reach cloud metadata endpoints. Patches are available in versions 7.5.4 and 8.4.0-alpha.2 and later, which remove this broken and dangerous feature entirely.
Affected products
- Parse Community Parse Server 4.2.0 to 7.5.3, 8.0.0 to 8.4.0-alpha.1
Timeline
- 2025-11-05: disclosed: Security advisory published
- 2025-11-05: patched: Patches released in versions 7.5.4 and 8.4.0-alpha.2