Description
Parse Server crashes when if a query request contains an invalid value for the explain option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch.
Recommendation
Update the parse-server package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.10.3
- Patched version(s): 4.10.3
References
- GHSA-xqp8-w826-hh6x
- jira.mongodb.org
- CVE-2021-39187
- CWE-20
- CWE-74
- CWE-755
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- LiveQuery publishes user session tokens in parse-server - CVE-2021-41109
- parse-server crashes when receiving file download request with invalid byte range - CVE-2022-39313
- parse-server new anonymous user session acts as if it's created with password - CVE-2021-39138
- Parse Server stores password in plain text - CVE-2020-26288
- Tags:
- npm
- parse-server
Anything's wrong? Let us know Last updated on January 30, 2023