Parse Server File API Access Control Bypass Vulnerability

A vulnerability exists in Parse Server versions prior to 8.6.5 and 9.5.0-alpha.3, allowing the readOnlyMasterKey to bypass restrictions and manipulate files through the Files API. This issue affects any deployment that uses the readOnlyMasterKey and exposes the Files API. An attacker with access to the readOnlyMasterKey can upload arbitrary files or delete existing ones, violating the intended access controls.

Impact

Exploitation of this vulnerability allows for unauthorized file creation and deletion via the Files API, bypassing the readOnlyMasterKey's intended restrictions. This could lead to arbitrary file uploads or the removal of critical files from the server.

Remediation

Users can upgrade to Parse Server versions 8.6.5 or 9.5.0-alpha.3, both of which include the necessary patch. Instructions for downloading these versions are available on the Parse Server GitHub releases page.