| Package | Affected versions | Patched versions |
|---|---|---|
| parse-server | = 9.7.0≥ 9.0.0, < 9.7.0< 8.6.67 | 9.7.08.6.67 |
| parse-server | ≥ 9.0.0, < 9.7.0-alpha.11< 8.6.67 | 9.7.0-alpha.118.6.67 |
An attacker can bypass Cloud Function validator access controls by appending .prototype.constructor to the function name in the URL. When a Cloud Function handler is declared using the function keyword and its validator is a plain object or arrow function, the trigger store traversal resolves the handler through its own prototype chain while the validator store fails to mirror this traversal, causing all access control enforcement to be skipped.
This allows unauthenticated callers to invoke Cloud Functions that are meant to be protected by validators such as requireUser, requireMaster, or custom validation logic.
The trigger store traversal now verifies that each intermediate node is a legitimate store object before continuing traversal. If the traversal encounters a non-store value such as a function handler, it stops and returns an empty store, preventing prototype chain escape.
Use arrow functions instead of the function keyword for Cloud Function handlers. Arrow functions do not have a prototype property and are not affected by this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free