CVE-2022-31112
📋 TL;DR
Parse Server LiveQuery improperly exposes protected fields to clients, allowing unauthorized access to sensitive data. This affects all Parse Server deployments using LiveQuery functionality with protected fields defined. Users running affected versions are vulnerable to information disclosure.
💻 Affected Systems
- Parse Server
📦 What is this software?
Parse Server by Parseplatform
Parse Server by Parseplatform
⚠️ Risk & Real-World Impact
Worst Case
Exposure of sensitive protected fields like passwords, API keys, or personal data to unauthorized clients, leading to data breaches and compliance violations.
Likely Case
Accidental exposure of protected fields containing business logic or configuration data that should remain server-side only.
If Mitigated
No data exposure if protected fields are properly filtered or if LiveQuery is disabled for sensitive classes.
🎯 Exploit Status
Exploitation requires client access to LiveQuery subscriptions but no special authentication beyond normal LiveQuery access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.2.4
Vendor Advisory: https://github.com/parse-community/parse-server/releases/tag/5.2.4
Restart Required: Yes
Instructions:
1. Update Parse Server to version 5.2.4 or later using npm: 'npm update parse-server' 2. Restart the Parse Server application 3. Verify the update with 'npm list parse-server'
🔧 Temporary Workarounds
Manual protected field filtering
allUse Parse.Cloud.afterLiveQueryEvent to manually remove protected fields from LiveQuery responses
Parse.Cloud.afterLiveQueryEvent('YourClassName', (request) => { delete request.object.get('protectedField'); });
🧯 If You Can't Patch
- Disable LiveQuery for classes containing protected fields
- Implement network segmentation to restrict LiveQuery client access
🔍 How to Verify
Check if Vulnerable:
Check if Parse Server version is below 5.2.4 and LiveQuery is enabled with protected fields defined.Check Version:
npm list parse-server | grep parse-serverVerify Fix Applied:
After updating to 5.2.4+, test that protected fields are no longer visible in LiveQuery responses.📡 Detection & Monitoring
Log Indicators:
- Unusual LiveQuery subscription patterns to classes with protected fields
- Increased data volume in LiveQuery responses
Network Indicators:
- Clients accessing LiveQuery endpoints and receiving unexpected field data
SIEM Query:
source="parse-server" AND "LiveQuery" AND ("protected" OR "sensitive")🔗 References
- https://github.com/parse-community/parse-server/commit/309f64ced8700321df056fb3cc97f15007a00df1
- https://github.com/parse-community/parse-server/commit/9fd4516cde5c742f9f29dd05468b4a43a85639a6
- https://github.com/parse-community/parse-server/issues/8073
- https://github.com/parse-community/parse-server/pull/8074
- https://github.com/parse-community/parse-server/releases/tag/5.2.4
- https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh
- https://github.com/parse-community/parse-server/commit/309f64ced8700321df056fb3cc97f15007a00df1
- https://github.com/parse-community/parse-server/commit/9fd4516cde5c742f9f29dd05468b4a43a85639a6
- https://github.com/parse-community/parse-server/issues/8073
- https://github.com/parse-community/parse-server/pull/8074
- https://github.com/parse-community/parse-server/releases/tag/5.2.4
- https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh
