Executive Summary

This vulnerability affects Parse Server, an open source backend for Node.js. Before versions 9.6.0-alpha.24 and 8.6.47, remote clients could crash the Parse Server by calling a cloud function endpoint with a specially crafted function name. This crafted name exploits the JavaScript prototype chain traversal of a registered cloud function handler, causing a stack overflow and crashing the server process.

The issue arises because the server resolves cloud function names by looking up properties along the prototype chain, which can be manipulated to cause excessive recursion. The fix restricts property lookups to own properties only, preventing prototype chain traversal and thus avoiding the stack overflow.

There is no known workaround other than upgrading to the fixed versions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow remote attackers to crash the Parse Server process by sending a crafted request. This results in a denial of service (DoS) condition, making the backend unavailable to legitimate users until the server is restarted or patched.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Parse Server to version 9.6.0-alpha.24 or later, or 8.6.47 or later. These versions include a fix that restricts property lookups during cloud function name resolution to own properties only, preventing prototype chain traversal and the resulting stack overflow.

There is no known workaround for this vulnerability, so upgrading is the immediate and necessary step.

Useful 0 Not Useful 0