AIKIDO-2024-10047
parse-server is vulnerable to SQL Injection
99
Critical Risk
This Affects:
parse-serverTL;DR
Versions of this package impacted by this issue are vulnerable to SQL Injection through a malicious PostgreSQL statement containing multiple quoted strings. This vulnerability occurs only when using the PostgreSQL engine.
Who does this affect?
You are affected if you are using a version which is within vulnerability ranges and if you are using the PostgreSQL engine.
Background info
parse-server is vulnerable to SQL Injection in versions 2.2.14 - 6.4.0.
How to fix this
Upgrade the parse-server library to the patch version.
Links
GitHub Releases
Fix Commits
github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.