Executive Summary

This vulnerability exists in Parse Server's LiveQuery WebSocket interface prior to versions 8.6.53 and 9.6.0-alpha.42. The issue is that the interface does not enforce Class-Level Permission (CLP) pointer permissions, specifically readUserFields and pointerFields.

As a result, any authenticated user can subscribe to LiveQuery events and receive real-time updates for all objects in classes that are supposed to be protected by pointer permissions. This means users can access data even if the pointer fields on those objects do not point to them, bypassing the intended read access control.

This leads to unauthorized access to potentially sensitive data that would normally be restricted when accessed via the REST API.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows unauthorized users to receive real-time updates on data they should not have access to, potentially exposing sensitive information.

This unauthorized access can lead to data leakage, privacy violations, and compromise of confidential information within applications using Parse Server versions affected by this issue.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Parse Server to version 8.6.53 or later, or to version 9.6.0-alpha.42 or later, where the issue has been patched.

Useful 0 Not Useful 0