N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-9xp9-j92r-p88v

GHSA-9xp9-j92r-p88v: Parse Server crash via deeply nested query condition operators

Impact

An unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients.

Patches

A depth limit for query condition operator nesting has been added via the requestComplexity.queryDepth server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app.

Workarounds

None.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-9xp9-j92r-p88v

GHSA-9xp9-j92r-p88v:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0, < 9.6.0-alpha.21	9.6.0-alpha.21
parse-server	npm	< 8.6.45	8.6.45

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the validateQuery function located in src/Controllers/DatabaseController.js. This function is responsible for validating query objects sent to the Parse Server. The vulnerability is an uncontrolled recursion issue. When the server receives a query with deeply nested logical operators such as $or, $and, or $nor, the validateQuery function calls itself recursively for each level of nesting. Before the patch, there was no limit to this recursion. An unauthenticated attacker could craft a request with a very deep nesting of these operators, causing the Node.js call stack to overflow, which in turn crashes the entire server process, resulting in a Denial of Service (DoS). The patch introduces a queryDepth limit within the requestComplexity server options. The validateQuery function was modified to track the current nesting depth and throw an error if it exceeds the configured limit, thus preventing the crash. The functions DatabaseController.findAndCount, DatabaseController.update, and DatabaseController.destroy are the primary entry points that accept user queries and pass them to the vulnerable validateQuery function.

Vulnerable functions

validateQuery

src/Controllers/DatabaseController.js

The `validateQuery` function recursively calls itself to process nested query operators like `$or`, `$and`, and `$nor`. Prior to the patch, there was no check on the recursion depth. This allowed an attacker to send a query with deeply nested operators, causing a stack overflow due to excessive recursion, which would crash the Parse Server process.

DatabaseController.findAndCount

src/Controllers/DatabaseController.js

This function serves as an entry point for the vulnerability. It takes a user-provided query and passes it to the `validateQuery` function. A malicious, deeply nested query passed to `findAndCount` will trigger the uncontrolled recursion in `validateQuery`, leading to a server crash.

DatabaseController.update

src/Controllers/DatabaseController.js

This function serves as an entry point for the vulnerability. It takes a user-provided query and passes it to the `validateQuery` function. A malicious, deeply nested query passed to `update` will trigger the uncontrolled recursion in `validateQuery`, leading to a server crash.

DatabaseController.destroy

src/Controllers/DatabaseController.js

This function serves as an entry point for the vulnerability. It takes a user-provided query and passes it to the `validateQuery` function. A malicious, deeply nested query passed to `destroy` will trigger the uncontrolled recursion in `validateQuery`, leading to a server crash.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.