CVE-2023-46119
📋 TL;DR
Parse Server crashes when processing file uploads without file extensions, causing denial of service. This affects all Parse Server deployments running vulnerable versions, potentially disrupting backend services.
💻 Affected Systems
- Parse Server
📦 What is this software?
Parse Server by Parseplatform
Parse Server by Parseplatform
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage through repeated exploitation, leading to extended downtime and potential data unavailability.
Likely Case
Service disruption and temporary unavailability of Parse Server backend functionality.
If Mitigated
Minimal impact with proper monitoring and rapid incident response to restart services.
🎯 Exploit Status
Simple HTTP request with file upload payload triggers the crash.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.5.6 or 6.3.1
Vendor Advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579
Restart Required: Yes
Instructions:
1. Check current Parse Server version. 2. Update to 5.5.6 (for 5.x branch) or 6.3.1 (for 6.x branch). 3. Restart the Parse Server process.
🔧 Temporary Workarounds
File Extension Validation
allImplement middleware to reject file uploads without extensions before they reach Parse Server
Rate Limiting
allImplement rate limiting on file upload endpoints to limit impact of repeated attacks
🧯 If You Can't Patch
- Implement WAF rules to block file uploads without extensions
- Deploy Parse Server behind reverse proxy with request filtering capabilities
🔍 How to Verify
Check if Vulnerable:
Check if Parse Server crashes when uploading a file without extension via API endpointCheck Version:
npm list parse-server | grep parse-serverVerify Fix Applied:
Test file upload without extension and verify service remains operational📡 Detection & Monitoring
Log Indicators:
- Parse Server process crashes
- Error logs showing unhandled exceptions during file upload
- Increased restart frequency
Network Indicators:
- HTTP POST requests to /parse/files endpoint with files lacking extensions
- Sudden service unavailability
SIEM Query:
source="parse-server" AND ("crash" OR "unhandled exception") AND "upload"🔗 References
- https://github.com/parse-community/parse-server/commit/686a9f282dc23c31beab3d93e6d21ccd0e1328fe
- https://github.com/parse-community/parse-server/commit/fd86278919556d3682e7e2c856dfccd5beffbfc0
- https://github.com/parse-community/parse-server/releases/tag/5.5.6
- https://github.com/parse-community/parse-server/releases/tag/6.3.1
- https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579
- https://github.com/parse-community/parse-server/commit/686a9f282dc23c31beab3d93e6d21ccd0e1328fe
- https://github.com/parse-community/parse-server/commit/fd86278919556d3682e7e2c856dfccd5beffbfc0
- https://github.com/parse-community/parse-server/releases/tag/5.5.6
- https://github.com/parse-community/parse-server/releases/tag/6.3.1
- https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579
