Parse Server Class-Level Permission Bypass Vulnerability Allowing Protected Field Enumeration

A vulnerability in Parse Server prior to versions 9.6.0-alpha.6 and 8.6.32 allows for bypassing the protectedFields class-level permission. This is achieved through dot-notation in query WHERE clauses and sort parameters, enabling a binary oracle attack to enumerate protected field values. The issue affects both MongoDB and PostgreSQL deployments.

Impact

Exploitation of this vulnerability allows attackers to bypass class-level permissions on protected fields, enabling them to query or sort by sub-fields of these protected fields. This could lead to unauthorized access to sensitive data.

Remediation

Users can upgrade to Parse Server versions 9.6.0-alpha.6 or 8.6.32 to address this vulnerability.