Parse Server MongoDB Field Existence Disclosure

Executive Summary

This vulnerability is an information disclosure issue in Parse Server versions 9.10.6-alpha.1 to 9.10.8-alpha.1. It allows clients with write but not read access to determine if specific fields exist in a MongoDB database. Attackers send update requests using dot notation on top-level fields and observe whether the server returns internal errors or success responses to infer field existence.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor Parse Server logs for internal server errors during update operations using dot notation. Check for repeated failed update attempts on top-level fields by clients with write but not read access. Use network traffic analysis to identify suspicious update requests targeting MongoDB fields.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to learn sensitive information about your database schema, such as which fields exist in stored records. This could aid further attacks by revealing data structure details without direct read access. The impact is limited to MongoDB deployments; PostgreSQL deployments are unaffected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate data protection regulations like GDPR or HIPAA by enabling unauthorized disclosure of database schema details. It undermines access control measures and could lead to compliance violations if exploited to infer sensitive data structures.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Parse Server to version 9.10.8-alpha.1 or later. Restrict write access to objects that clients cannot read. Use Cloud Code with the master key for sensitive operations. Monitor for unusual update patterns and block suspicious requests.

Useful 0 Not Useful 0