Invalid file request can crash server

Description

Certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability impact may be low; if you are running Parse Server as a single instance without redundancy, the availability impact may be high.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.0.0, < 5.2.3

  < 4.10.12**

• Patched version(s): **5.2.3

  4.10.12**

References

• GHSA-xw6g-jjvf-wwf9
• CVE-2022-31089
• CWE-252
• CAPEC-310
• OWASP 2021-A6

Related Issues

• parse-server crashes when receiving file download request with invalid byte range - CVE-2022-39313
• Parse Server may crash when uploading file without extension - CVE-2023-46119
• parse-server auth adapter app ID validation can be circumvented - CVE-2022-39231
• parse-server's session object properties can be updated by foreign user if object ID is known - CVE-2022-39225

Tags:

npm

parse-server