-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| parse-server | npm | < 8.5.0-alpha.5 | 8.5.0-alpha.5 |
Miggo AIRoot Cause AnalysisThe vulnerability allows any client to execute MongoDB explain queries, which can expose sensitive database information. The patch addresses this by introducing a new configuration option, allowPublicExplain, and adding a check within the runFindTriggers function in src/rest.js. This function is the central point for handling find queries. The patch adds logic to this function to check if an explain query is being made (restOptions.explain) and if the request is from a user without master key privileges (!auth.isMaster). If allowPublicExplain is configured to be false, it throws an error, preventing the unauthorized execution of the explain query. The vulnerability, therefore, exists in the runFindTriggers function due to the absence of this authorization check in the vulnerable versions. The other modified files are related to the implementation of the new configuration option and associated security checks, but the core vulnerable logic is within runFindTriggers.
runFindTriggerssrc/rest.js
Ongoing coverage of React2Shell