Impact

This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database.

Patches

The algorithm to detect SQL injection has been improved.

Workarounds

None.

References

• GHSA-6927-3vr9-fxf2
• https://github.com/parse-community/parse-server/releases/tag/6.5.0 (fixed in Parse Server 6)
• https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20 (fixed in Parse Server 7 alpha release)

Credits

• Mikhail Shcherbakov (https://twitter.com/yu5k3) working with Trend Micro Zero Day Initiative (finder)
• Ehsan Persania (remediation developer)
• Manuel Trezza (coordinator)

References

• GHSA-6927-3vr9-fxf2
• https://nvd.nist.gov/vuln/detail/CVE-2024-27298
• parse-community/parse-server@a6e6549
• parse-community/parse-server@cbefe77
• https://github.com/parse-community/parse-server/releases/tag/6.5.0
• https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20