parse-server: Server crash via file pointer without URL in an object write

Impact

An attacker can crash the Parse Server process by saving an object that contains a file reference without a URL. This affects any class that has a Cloud Code save, find or delete trigger, or that is enabled for LiveQuery; with public write access to such a class, including user sign-up, no authentication is required. A file reference without a URL nested in an object or array can also be stored, after which requests that run a trigger or LiveQuery on that object fail.

Patches

File references without a URL are now resolved before objects are passed to Cloud Code triggers and LiveQuery, including file references nested in objects and arrays and file references set by a beforeSave trigger. Nested file references in query responses are now also resolved. File references with a missing or invalid name are rejected. Errors in the LiveQuery notification after a save are now caught and logged instead of terminating the process.

Workarounds

Add a middleware before Parse Server that rejects write requests whose body contains an object with __type set to File that has no url, or whose name is not a string. Note that this also rejects legitimate requests that reference an existing file by name only.

References

• GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-gpr6-gr9g-pfw6
• Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10694
• Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10695