| Package | Affected versions | Patched versions |
|---|---|---|
| parse-server | = 9.6.0≥ 9.0.0, < 9.6.0< 8.6.32 | 9.6.08.6.32 |
| parse-server | ≥ 9.0.0-alpha.1, < 9.6.0-alpha.6< 8.6.32 | 9.6.0-alpha.68.6.32 |
The protectedFields class-level permission (CLP) can be bypassed using dot-notation in query WHERE clauses and sort parameters. An attacker can use dot-notation to query or sort by sub-fields of a protected field, enabling a binary oracle attack to enumerate protected field values.
This affects both MongoDB and PostgreSQL deployments.
The fix ensures that query WHERE clause keys and sort keys are checked against protected fields by extracting the root field from dot-notation paths. For example, a query on secretObj.apiKey is now correctly blocked when secretObj is a protected field.
None.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free