Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot notation (e.g., stats.counter). The amount value is interpolated directly into the SQL query without parameterization or type validation. An attacker who can send write requests to the Parse Server REST API can inject arbitrary SQL subqueries to read any data from the database, bypassing CLPs and ACLs. MongoDB deployments are not affected. This vulnerability is fixed in 9.6.0-alpha.3 and 8.6.29.
The vulnerability occurs in the PostgreSQL database adapter when processing Increment operations on nested fields of objects using dot notation (e.g., stats.counter). The value of the 'amount' parameter is directly inserted into the SQL query without parameterization or type validation. An attacker sending write requests to the Parse Server REST API can inject arbitrary SQL subqueries, which will be executed by the database engine. The vulnerability does not affect instances using MongoDB.
An unauthenticated attacker can read any data stored in the PostgreSQL database, including data protected by CLP (Class Level Permissions) rules and ACL (Access Control Lists). This results in a complete breach of confidentiality of stored data.
Parse Server should be updated immediately to version 8.6.29 (stable branch) or 9.6.0-alpha.3 (alpha branch). Patches are available in the vendor references on GitHub. Until the update is applied, consider restricting access to the Parse Server REST API at the network level.
Parseplatform Parse Server in all versions before 8.6.29 (8.x branch) and before 9.6.0-alpha.3 (9.x branch) using the PostgreSQL adapter. Deployments based on MongoDB are not vulnerable.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XParseplatform Parse Server
APPParseplatform9.6.0< 8.6.299.0.0 – 9.6.0 (excl.)
Related vulnerabilities
Parse Server: obejście walidatorów Cloud Functions przez prototype chain
Race condition w Parse Server — błędna walidacja tokenów OAuth2
Parse Server — przejęcie konta przez manipulację zapytaniem (Auth Bypass)
SQL Injection w Parse Server poprzez dot-notation i parametr sort (PostgreSQL)
SQL Injection w Parse Server (PostgreSQL) — operacje Increment na polach zagnieżdżonych