CVE-2022-31112: Open Source Vulnerability in Parse Server LiveQuery
Summary
CVE-2022-31112: Protected fields exposed via LiveQuery in parse-server. Affects parse across 2 version ranges.
< 4.10.13
>= 5.0.0, < 5.2.4
Fixed in 4.10.13 or 5.2.4, depending on the release line you run. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2022-31112 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open source backend that can be deployed to any infrastructure running Node.js. It provides a platform for building scalable and customizable applications. The LiveQuery feature in Parse Server allows real-time data updates between the server and clients. However, in affected versions, Parse Server LiveQuery fails to remove protected fields in classes, exposing them to clients. This vulnerability can lead to unauthorized access and disclosure of sensitive information.
Vulnerability Detail
The vulnerability (CVE-2022-31112) in Parse Server LiveQuery arises from the failure to remove protected fields in classes when sending data to clients. This means that protected fields, which should be hidden from clients, are inadvertently exposed. Attackers can exploit this vulnerability to gain access to sensitive information that should be protected. The impact of this vulnerability can be severe, as it can lead to unauthorized access, data breaches, and potential compromise of user privacy.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.10.134.10.13 -
>= 5.0.0, < 5.2.45.2.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to upgrade to the fixed versions, you can use the following code snippet as a workaround:
Parse.Cloud.afterLiveQueryEvent((event) => {
// Manually remove protected fields from the client response
const protectedFields = ['field1', 'field2'];
const response = event.response;
protectedFields.forEach((field) => {
if (response[field]) {
delete response[field];
}
});
return response;
});
Conclusion
The vulnerability (CVE-2022-31112) in Parse Server LiveQuery exposes protected fields to clients, potentially leading to unauthorized access and disclosure of sensitive information. Users are strongly advised to upgrade to the fixed versions of Parse Server or apply the provided workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for parse →
FAQ
Parse Server is an open source backend that can be deployed to any infrastructure running Node.js. It provides a platform for building scalable and customizable applications.
LiveQuery is a feature in Parse Server that enables real-time data updates between the server and clients. It allows clients to subscribe to queries and receive updates whenever the queried data changes.
This vulnerability can lead to unauthorized access and disclosure of sensitive information. Attackers can exploit this vulnerability to gain access to protected fields that should be hidden from clients, potentially compromising user privacy and causing data breaches.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Parse Server. For versions 4.x, upgrade to version 4.10.13 or later. For versions 5.x, upgrade to version 5.2.4 or later. Alternatively, if you are unable to upgrade, you can use the Parse.Cloud.afterLiveQueryEvent function to manually remove protected fields from the client response.
Yes, if you are unable to upgrade to the fixed versions, you can use the provided code snippet as a workaround. The code snippet demonstrates how to manually remove protected fields from the client response in LiveQuery.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
