GHSA-wc3c-6843-q7mv: Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update
Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writable without a session, can send such an update to crash the Node process.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 8.6.110 - Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 9.10.6-alpha.2
Event History
Frequently Asked Questions
Which deployments are most exposed to unauthenticated denial-of-service attempts?
Deployments where clients can write objects without a session are exposed to unauthenticated exploitation. The affected update must target a pointer field's object identifier using a dot-notation key on a class that has an afterSave trigger.
What must an attacker send to trigger the crash?
An attacker needs to submit an object update using a dot-notation key that targets the object identifier of a pointer field. The affected class must have an afterSave trigger; successful triggering can crash the Node process.
Which versions are affected?
Affected versions are Parse Server releases before 8.6.110, and releases from 9.0.0 before 9.10.6-alpha.2.