CVE-2022-31112: Protected fields exposed via LiveQuery in parse-server
Impact
Parse Server LiveQuery does not remove protected fields in classes, passing them to the client.
Patches The LiveQueryController now removes protected fields from the client response.
Workarounds Use Parse.Cloud.afterLiveQueryEvent to manually remove protected fields.
References - https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh - https://github.com/parse-community/parse-server
For more information If you have any questions or comments about this advisory: - For questions or comments about this vulnerability visit our community forum or community chat - Report other vulnerabilities at report.parseplatform.org
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client response. Users are advised to upgrade. Users unable t upgrade should use Parse.Cloud.afterLiveQueryEvent to manually remove protected fields.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-31112?
CVE-2022-31112 is a vulnerability in Parse Server where protected fields in classes are not removed in Parse Server LiveQuery responses.
How does CVE-2022-31112 impact Parse Server?
CVE-2022-31112 allows protected fields in classes to be passed to the client in Parse Server LiveQuery.
What is the severity of CVE-2022-31112?
The severity of CVE-2022-31112 is high, with a CVSS score of 8.2.
How can I fix CVE-2022-31112 in Parse Server?
You can fix CVE-2022-31112 in Parse Server by upgrading to version 5.2.4 or later.
Are there any workarounds for CVE-2022-31112?
Yes, you can use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields as a workaround for CVE-2022-31112.