Uncaught Exception in Parse Server - #VU152595

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an uncaught exception in Parse Server file reference handling when saving an object containing a file reference without a URL. A remote attacker can save a specially crafted object to cause a denial of service.

Exploitation requires public write access to an affected class with a Cloud Code save, find, or delete trigger, or with LiveQuery enabled.

Affected software

Remediation

External References

• https://github.com/parse-community/parse-server/security/advisories/GHSA-gpr6-gr9g-pfw6
• https://github.com/parse-community/parse-server/pull/10694

Related Security Bulletins

• Uncaught Exception in Parse Server