GHSA-2rcp-jc67-vq74: Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response
Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access, so clients whose class-level permissions or object ACLs allow update but not read can see object data. Attackers can update such objects to read atomic operation results (Increment, Add, AddUnique, Remove), Cloud Code trigger-set values, and, for dot notation keys under certain conditions, the whole stored parent field.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running Parse Server versions before 8.6.109, or versions from 9.0.0 through before 9.10.6-alpha.1, are affected where a client can update an object but lacks read access to it.
What access does an attacker need?
An attacker needs permission to update the target object through class-level permissions or an object ACL. No read permission is required, and user interaction is not required.
What information can be disclosed?
An update response can expose results of atomic operations such as Increment, Add, AddUnique, and Remove, as well as values set by Cloud Code triggers. Under certain conditions, updating a dot-notation key can disclose the entire stored parent field.
How can I determine whether my access controls are at risk?
Review classes and object ACLs for principals that can update objects without also having read access. Those update-only access paths can receive stored field values in object update responses on affected versions.