AIKIDO-2024-10048
parse-server is vulnerable to Improper Input Validation
85
High Risk
This Affects:
parse-serverTL;DR
Versions of this package impacted by this issue are vulnerable due to inadequate input validation for Cloud Function and Cloud Job names. Exploiting this flaw allows an attacker to trigger a Denial of Service or execute arbitrary code by sending a specially crafted request.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
parse-server is vulnerable to Improper Input Validation in versions 3.0.0 - 6.5.4.
How to fix this
Upgrade the parse-server library to the patch version.
Links
GitHub Releases
Fix Commits
github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179bgithub.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.