Headline
GHSA-xw6g-jjvf-wwf9: Invalid file request can crash server
Impact
Certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability impact may be low; if you are running Parse Server as a single instance without redundancy, the availability impact may be high.
Patches
To prevent this, invalid requests are now properly handled.
Workarounds
None
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-xw6g-jjvf-wwf9
- https://github.com/parse-community/parse-server
For more information
- For questions or comments about this vulnerability visit our community forum or community chat
- Report other vulnerabilities at report.parseplatform.org
Package
npm parse-server (npm)
Affected versions
< 4.10.12
>= 5.0.0, < 5.2.3
Patched versions
4.10.12
5.2.3
Description
Impact
Certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability impact may be low; if you are running Parse Server as a single instance without redundancy, the availability impact may be high.
Patches
To prevent this, invalid requests are now properly handled.
Workarounds
None
References
- GHSA-xw6g-jjvf-wwf9
- https://github.com/parse-community/parse-server
For more information
- For questions or comments about this vulnerability visit our community forum or community chat
- Report other vulnerabilities at report.parseplatform.org
References
- GHSA-xw6g-jjvf-wwf9
mtrezza published the maintainer security advisory
Jun 17, 2022
Severity
High
7.5
/ 10
CVSS base metrics
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
No CWEs
CVE ID
CVE-2022-31089
GHSA ID
GHSA-xw6g-jjvf-wwf9
Source code
parse-community/parse-server
Credits
- mtrezza
See something to contribute? Suggest improvements for this vulnerability.
Related news
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability impact may be low; if you are running Parse Server as single instance without redundancy, the availability impact may be high. This issue has been addressed in versions 4.10.12 and 5.2.3. Users are advised to upgrade. There are no known workarounds for this issue.