-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability is a Server-Side Request Forgery (SSRF) located in the file upload functionality of Parse Server. The root cause is the downloadFileFromURI function in src/Routers/FilesRouter.js, which makes an HTTP request to a user-provided URI without proper validation. This function is called by addFileDataIfNeeded when a file upload request specifies the uri format. The vulnerability is triggered within the POST route handler for /files/:fileName, which is defined in the expressRouter method of the FilesRouter class. The patch mitigates this vulnerability by completely removing the downloadFileFromURI and addFileDataIfNeeded functions, along with the call to addFileDataIfNeeded within the route handler, effectively disabling the feature of uploading files from a URI.
downloadFileFromURIsrc/Routers/FilesRouter.js
addFileDataIfNeededsrc/Routers/FilesRouter.js
FilesRouter.expressRoutersrc/Routers/FilesRouter.js
Ongoing coverage of React2Shell
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| parse-server | npm | >= 4.2.0, < 7.5.4 | 7.5.4 |
| parse-server | npm | >= 8.0.0, <= 8.4.0-alpha.1 | 8.4.0-alpha.2 |