Parse Server Count Query Membership Disclosure via $relatedTo Operator

Executive Summary

This vulnerability affects Parse Server versions before 8.6.93 and 9.0.0 before 9.10.1-alpha.13. It allows authenticated users with read access to an object to bypass protectedFields restrictions on count queries using the $relatedTo operator. This can expose confidential memberships like private groups or block lists by inferring relation sizes or confirming object links.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Parse Server logs for count queries using the $relatedTo operator combined with objectId constraints. Check for unauthorized attempts to infer protected Relation fields or memberships. No specific commands are provided in the context, but monitoring for unusual count query patterns may help.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to determine if a user is part of a private group or blocked list by combining count queries with objectId constraints. This could lead to privacy breaches, unauthorized data exposure, or social engineering attacks. The impact is higher for systems handling sensitive data like user groups or access controls.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data protection, such as GDPR's data minimization and security principles or HIPAA's access controls. Unauthorized exposure of membership data may result in regulatory penalties or loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Parse Server to versions 8.6.93 or later and 9.10.1-alpha.13 or later. If upgrading is not possible, apply mitigations such as protecting sensitive Relation fields for the public group, denying count class-level permissions for untrusted users, or enforcing access controls in a beforeFind trigger.

Useful 0 Not Useful 0