parse-server: Unauthenticated deletion of class schemas removes class-level permissions on MongoDB

Impact

On deployments that use MongoDB, a client without the master key can delete the stored schema of any class through the REST API. This removes the class's field definitions, class-level permissions and protected fields, including those set with the protectedFields server option. Data protected only by these can then become readable and modifiable by any client, and a class can become inaccessible to clients until it is re-created. Object ACLs continue to apply. Deployments that use PostgreSQL are not affected.

Patches

Client requests to class names that are not valid class names, including the internal schema collection, are now rejected unless they use the master key or maintenance key.

Workarounds

Register a Cloud Code beforeDelete trigger for the class name _SCHEMA that rejects requests without the master key. Upgrading does not restore schemas that were already deleted; review the class-level permissions, protected fields and field definitions of all classes and restore them where needed.

References

• GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-qmg9-m772-5rm7
• Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10767
• Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10768