Executive Summary

This vulnerability affects Parse Server versions prior to 8.6.54 and 9.6.0-alpha.43. An attacker can subscribe to LiveQuery with a watch parameter targeting a protected field. Although the actual value of the protected field is not exposed in event payloads, the attacker can observe the presence or absence of update events to determine whether the protected field has changed. This creates a binary oracle that leaks information about the protected field's state. For boolean protected fields, the timing of these change events effectively reveals the field's value.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to information disclosure by allowing an attacker to infer changes to protected fields that should remain confidential. This leakage can compromise the privacy of sensitive data, especially boolean protected fields, by revealing their values through timing analysis of update events.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring LiveQuery subscription requests that include the "watch" parameter targeting protected fields or their nested properties. Specifically, look for subscription attempts that try to watch fields marked as protected, such as "secretObj" or nested keys like "secretObj.apiKey".'}, {'type': 'paragraph', 'content': 'To detect such attempts, you can inspect your Parse Server logs or network traffic for LiveQuery subscription requests containing the "watch" parameter with protected field names.'}, {'type': 'paragraph', 'content': 'Example commands to detect suspicious LiveQuery subscriptions might include:'}, {'type': 'list_item', 'content': "Using grep on server logs to find subscriptions watching protected fields: grep -i 'watch.*secretObj' parse-server.log"}, {'type': 'list_item', 'content': 'Using network traffic capture tools (e.g., tcpdump or Wireshark) to filter WebSocket messages containing the watch parameter with protected fields.'}, {'type': 'list_item', 'content': 'Implement server-side logging or middleware to log and alert on LiveQuery subscription requests that include protected fields in the watch parameter.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'The immediate mitigation step is to upgrade your Parse Server to version 8.6.54 or later, or 9.6.0-alpha.43 or later, where this vulnerability has been patched.'}, {'type': 'paragraph', 'content': 'The patch enforces explicit checks on the LiveQuery "watch" parameter, rejecting subscription requests that attempt to watch protected fields or their nested properties unless the client has master key privileges.'}, {'type': 'paragraph', 'content': 'Until you can upgrade, consider restricting LiveQuery access or disabling LiveQuery subscriptions that include the watch parameter for protected fields, and monitor for suspicious subscription attempts.'}] [1]

Useful 0 Not Useful 0