Executive Summary

This vulnerability exists in Parse Server versions prior to 9.5.2-alpha.10 and 8.6.23. The issue is that the rate limiting middleware, which is supposed to limit the number of requests a client can make, is applied at the Express middleware layer. However, the batch request endpoint (/batch) processes multiple sub-requests internally by routing them directly through the Promise router, bypassing the Express middleware including the rate limiting feature.

As a result, an attacker can bundle multiple requests targeting a rate-limited endpoint into a single batch request, effectively circumventing the configured rate limit.

Any Parse Server deployment that relies on the built-in rate limiting feature is affected by this vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to bypass rate limiting controls by sending multiple requests within a single batch request. This can lead to excessive usage of server resources, potentially causing denial of service or degraded performance.

It may also enable attackers to perform brute force attacks or abuse APIs that are supposed to be rate limited, increasing the risk of unauthorized access or data exposure.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Parse Server deployment to version 9.5.2-alpha.10 or later, or 8.6.23 or later, where the issue has been fixed.

This update ensures that the rate limiting middleware is properly applied to batch requests, preventing attackers from bypassing rate limits by bundling multiple requests.

Useful 0 Not Useful 0