| Package | Affected versions | Patched versions |
|---|---|---|
| parse-server | = 9.6.0≥ 9.0.0, < 9.6.0< 8.6.59 | 9.6.08.6.59 |
| parse-server | ≥ 9.0.0, < 9.6.0-alpha.53< 8.6.59 | 9.6.0-alpha.538.6.59 |
An attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access.
Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected.
Field names in the aggregate $group._id object values and distinct dot-notation parameters are now validated to only contain alphanumeric characters and underscores, preventing SQL injection via the :raw interpolation used in the PostgreSQL storage adapter.
No workaround. Upgrade to a patched version.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free