Invalid file request can crash server

Description

Certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability impact may be low; if you are running Parse Server as a single instance without redundancy, the availability impact may be high.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.0.0, < 5.2.3

  < 4.10.12**

• Patched version(s): **5.2.3

  4.10.12**

References

• GHSA-xw6g-jjvf-wwf9
• CVE-2022-31089
• CWE-252
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Information disclosure in parse-server - CVE-2020-5251
• Potential XSS vulnerability in jQuery - CVE-2020-11023
• Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
• Prototype Pollution in jquery-deparam - CVE-2021-20087

Tags:

npm

parse-server