Parse Server SQL Injection Vulnerability in PostgreSQL Deployments

A SQL injection vulnerability has been identified in Parse Server versions 9.0.0 prior to 9.6.0-alpha.2 and versions prior to 8.6.28. This vulnerability allows attackers to inject SQL into the PostgreSQL database by using a dot-notation field name with the sort query parameter, due to improper escaping of sub-field values in dot-notation queries. The issue may also arise with the distinct and where query parameters. The vulnerability only affects deployments using a PostgreSQL database.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to the database. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Remediation

Users can upgrade to Parse Server versions 9.6.0-alpha.2 or 8.6.28 to address this vulnerability.