parse-server: Object write with a reserved field name can make reads fail on MongoDB

Impact

Parse Server does not reject reserved internal field names in certain object writes. On deployments that use MongoDB, a client that is allowed to create objects in a class can store an object with a reserved field name that makes every subsequent read of that object fail, which disrupts queries on that class for all users until the field is removed from the database. In addition, a user can clear internal fields on records they are allowed to write, such as the account lockout state or password history of their own account, which circumvents the account lockout and password policy settings for that account. Deployments that use PostgreSQL are affected only by the latter.

Patches

Object writes from clients that contain reserved internal field names are rejected. Reading an object that contains an unexpected internal field from MongoDB no longer fails; the field is skipped and a warning is logged.

Workarounds

Register a beforeSave Cloud Code trigger, which may be empty, for every class that clients can write to, including the _User class. Parse Server then discards reserved field names from client requests before saving. Objects that already contain an unexpected internal field must be cleaned up by removing that field directly in the MongoDB database.

References

• GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-gwrq-q25v-g8mr
• Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10763
• Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10764