Anmelden
Deutsch English Español Polski
Mittel

Phishing attack vulnerability by uploading malicious HTML file

  • Veröffentlicht: 31.05.2023
  • Aktualisiert: 11.10.2026 10:22

Impact

Phishing attack vulnerability by uploading malicious files. A malicious user could upload a HTML file to Parse Server via its public API. That HTML file would then be accessible at the internet domain at which Parse Server is hosted. The URL of the the uploaded HTML could be shared for phishing attacks. The HTML page may seem legitimate because it is served under the internet domain where Parse Server is hosted, which may be the same as a company's official website domain.

An additional security issue arises when the Parse JavaScript SDK is used. The SDK stores sessions in the internet browser's local storage, which usually restricts data access depending on the internet domain. A malicious HTML file could contain a script that retrieves the user's session token from local storage and then share it with the attacker.

Patches

The fix adds a new Parse Server option fileUpload.fileExtensions to restrict file upload on Parse Server by file extension. It is recommended to restrict file upload for HTML file extensions, which this fix disables by default. If an app requires upload of files with HTML file extensions, the option can be set to ['.*'] or another custom value to override the default.

References

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

PlattformPaketAnfällige VersionenBehoben in
npm-Paket parse-server < 5.4.4, >= 6.0.0, < 6.1.1 5.4.4, 6.1.1

Verweise

CVSS-Wert 6.3/10
CVSS-Vektor
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Schwäche (CWE)
CWE-434
Plattform
npm
Paket
parse-server
Veröffentlicht
31.05.2023
Aktualisiert
11.10.2026 10:22

Quellen und Lizenzen

OSV / GitHub Advisory Database - GHSA-9prm-jqwx-45x9 - CC BY 4.0

Schwachstellenhistorie: parse-server

Alle veröffentlichten Schwachstellen dieses Pakets (npm-Paket), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (116) im Archiv
Einträge insgesamt
116
Erste → letzte
06.2019 06.2026
Ohne Fix
0
In Angriffen ausgenutzt
0

Verteilung nach Schweregrad

  • Kritisch 17
  • Hoch 49
  • Mittel 40
  • Niedrig 10

Veröffentlichungen pro Jahr

Schweregrad:
  1. parse-server: Denial of service via exponential-time processing of deeply nested query operators
    Hoch CVE-2026-57480 >= 9.0.0, < 9.9.1-alpha.12, < 8.6.82 9.9.1-alpha.12, 8.6.82
  2. Parse Server: Pre-authentication denial of service via client version header regex backtracking
    Hoch CVE-2026-47138 >= 9.0.0, < 9.9.1-alpha.1, < 8.6.77 9.9.1-alpha.1, 8.6.77
  3. Parser Server's streaming file download bypasses afterFind file trigger authorization
    Hoch CVE-2026-34784 >= 9.0.0, < 9.7.1-alpha.1, < 8.6.71 9.7.1-alpha.1, 8.6.71
  4. parse-server has GraphQL complexity validator exponential fragment traversal DoS
    Hoch CVE-2026-34573 >= 9.0.0, < 9.7.0-alpha.12, < 8.6.68 9.7.0-alpha.12, 8.6.68
  5. parse-server has cloud function validator bypass via prototype chain traversal
    Kritisch CVE-2026-34532 >= 9.0.0, < 9.7.0-alpha.11, < 8.6.67 9.7.0-alpha.11, 8.6.67
  6. LiveQuery protected field leak via shared mutable state across concurrent subscribers
    Hoch CVE-2026-34363 >= 9.0.0, < 9.7.0-alpha.9, < 8.6.65 9.7.0-alpha.9, 8.6.65
  7. Parse Server exposes auth data via verify password endpoint
    Hoch CVE-2026-34215 >= 9.0.0, < 9.7.0-alpha.7, < 8.6.63 9.7.0-alpha.7, 8.6.63
  8. Parse Server exposes auth data via /users/me endpoint
    Hoch CVE-2026-33627 >= 9.0.0, < 9.6.0-alpha.55, < 8.6.61 9.6.0-alpha.55, 8.6.61
  9. Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
    Hoch CVE-2026-33539 >= 9.0.0, < 9.6.0-alpha.53, < 8.6.59 9.6.0-alpha.53, 8.6.59
  10. Parse Server: Denial of Service via unindexed database query for unconfigured auth providers
    Hoch CVE-2026-33538 >= 9.0.0, < 9.6.0-alpha.52, < 8.6.58 9.6.0-alpha.52, 8.6.58
  11. Parse Server LiveQuery subscription query depth bypass
    Hoch · 7.5 CVE-2026-33508 >= 9.0.0, < 9.6.0-alpha.45, < 8.6.56 9.6.0-alpha.45, 8.6.56
  12. Parse Server has a query condition depth bypass via pre-validation transform pipeline
    Hoch · 7.5 CVE-2026-33498 >= 9.0.0, < 9.6.0-alpha.44, < 8.6.55 9.6.0-alpha.44, 8.6.55
  13. Parse Server's LiveQuery bypasses CLP pointer permission enforcement
    Hoch · 6.5 CVE-2026-33421 >= 9.0.0, < 9.6.0-alpha.42, < 8.6.53 9.6.0-alpha.42, 8.6.53
  14. Parse Server has an auth provider validation bypass on login via partial authData
    Hoch · 9.1 CVE-2026-33409 >= 9.0.0, < 9.6.0-alpha.41, < 8.6.52 9.6.0-alpha.41, 8.6.52
  15. Parse Server leaks protected fields via LiveQuery afterEvent trigger
    Hoch CVE-2026-33163 >= 9.0.0, < 9.6.0-alpha.35, < 8.6.50 9.6.0-alpha.35, 8.6.50
  16. Parse Server's Cloud function dispatch crashes server via prototype chain traversal
    Hoch CVE-2026-32886 >= 9.0.0, < 9.6.0-alpha.24, < 8.6.47 9.6.0-alpha.24, 8.6.47
  17. Parse Server crash via deeply nested query condition operators
    Hoch CVE-2026-32944 >= 9.0.0, < 9.6.0-alpha.21, < 8.6.45 9.6.0-alpha.21, 8.6.45
  18. Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
    Hoch CVE-2026-32728 >= 9.0.0, < 9.6.0-alpha.15, < 8.6.41 9.6.0-alpha.15, 8.6.41
  19. Parse Server: Account takeover via operator injection in authentication data identifier
    Kritisch CVE-2026-32248 >= 9.0.0, < 9.6.0-alpha.12, < 8.6.38 9.6.0-alpha.12, 8.6.38
  20. Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance
    Kritisch CVE-2026-32242 >= 9.0.0, < 9.6.0-alpha.11, < 8.6.37 9.6.0-alpha.11, 8.6.37
  21. Parse Server's MFA recovery codes not consumed after use
    Hoch CVE-2026-31875 >= 9.0.0-alpha.1, < 9.6.0-alpha.7, < 8.6.33 9.6.0-alpha.7, 8.6.33
  22. Parse Server has a protected fields bypass via dot-notation in query and sort
    Hoch CVE-2026-31872 >= 9.0.0-alpha.1, < 9.6.0-alpha.6, < 8.6.32 9.6.0-alpha.6, 8.6.32
  23. Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
    Kritisch CVE-2026-31871 >= 9.0.0-alpha.1, < 9.6.0-alpha.5, < 8.6.31 9.6.0-alpha.5, 8.6.31
  24. Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL
    Kritisch CVE-2026-31856 >= 9.0.0-alpha.1, < 9.6.0-alpha.3, < 8.6.29 9.6.0-alpha.3, 8.6.29
  25. Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes
    Hoch CVE-2026-31800 >= 9.0.0-alpha.1, < 9.5.2-alpha.12, < 8.6.25 9.5.2-alpha.12, 8.6.25
  26. Parse Server OAuth2 authentication adapter account takeover via identity spoofing
    Hoch CVE-2026-30967 >= 9.0.0-alpha.1, < 9.5.2-alpha.9, < 8.6.22 9.5.2-alpha.9, 8.6.22
  27. Parse Server has role escalation and CLP bypass via direct `_Join` table write
    Kritisch · 10.0 CVE-2026-30966 >= 9.0.0-alpha.1, < 9.5.2-alpha.7, < 8.6.20 9.5.2-alpha.7, 8.6.20
  28. Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter
    Kritisch CVE-2026-30965 >= 9.0.0-alpha.1, < 9.5.2-alpha.8, < 8.6.21 9.5.2-alpha.8, 8.6.21
  29. Parse Server has a protected fields bypass via logical query operators
    Hoch CVE-2026-30962 >= 9.0.0, < 9.5.2-alpha.6, < 8.6.19 9.5.2-alpha.6, 8.6.19
  30. Parse Server missing audience validation in Keycloak authentication adapter
    Hoch CVE-2026-30949 >= 9.0.0, < 9.5.2-alpha.5, < 8.6.18 9.5.2-alpha.5, 8.6.18
  31. Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload
    Hoch CVE-2026-30948 >= 9.0.0, < 9.5.2-alpha.4, < 8.6.17 9.5.2-alpha.4, 8.6.17
  32. Parse Server has a bypass of class-level permissions in LiveQuery
    Hoch CVE-2026-30947 >= 9.0.0, < 9.5.2-alpha.3, < 8.6.16 9.5.2-alpha.3, 8.6.16
  33. Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API
    Hoch CVE-2026-30946 < 8.6.15, >= 9.0.0, < 9.5.2-alpha.2 8.6.15, 9.5.2-alpha.2
  34. Parse Server has a NoSQL injection via token type in password reset and email verification endpoints
    Hoch CVE-2026-30941 >= 9.0.0, < 9.5.2-alpha.1, < 8.6.14 9.5.2-alpha.1, 8.6.14
  35. Parse Server: SQL injection via dot-notation field name in PostgreSQL
    Kritisch CVE-2026-31840 >= 9.0.0, < 9.6.0-alpha.2, < 8.6.28 9.6.0-alpha.2, 8.6.28
  36. Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution
    Hoch CVE-2026-30939 < 8.6.13, >= 9.0.0-alpha.1, < 9.5.1-alpha.2 8.6.13, 9.5.1-alpha.2
  37. Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
    Hoch CVE-2026-30925 >= 9.0.0-alpha.1, < 9.5.0-alpha.14, < 8.6.11 9.5.0-alpha.14, 8.6.11
  38. Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
    Kritisch CVE-2026-30863 >= 9.0.0-alpha.1, < 9.5.0-alpha.11, < 8.6.10 9.5.0-alpha.11, 8.6.10
  39. parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user
    Hoch CVE-2026-30229 < 8.6.6, >= 9.0.0, < 9.5.0-alpha.4 8.6.6, 9.5.0-alpha.4
  40. Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction
    Hoch CVE-2026-29182 >= 9.0.0, < 9.4.1-alpha.3, < 8.6.4 9.4.1-alpha.3, 8.6.4
  41. Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter
    Kritisch CVE-2026-27804 >= 9.0.0, < 9.3.1-alpha.4, < 8.6.3 9.3.1-alpha.4, 8.6.3
  42. Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter
    Hoch CVE-2025-68150 >= 9.0.0, < 9.1.1-alpha.1, < 8.6.2 9.1.1-alpha.1, 8.6.2
  43. Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format
    Hoch · 7.5 CVE-2025-64430 >= 4.2.0, < 7.5.4, >= 8.0.0, < 8.4.0-alpha.2 7.5.4, 8.4.0-alpha.2
  44. Parse Server's custom object ID allows to acquire role privileges
    Hoch · 8.1 CVE-2024-47183 < 6.5.9, >= 7.0.0, < 7.3.0 6.5.9, 7.3.0
  45. ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
    Kritisch · 9.8 CVE-2024-39309 < 6.5.7, >= 7.0.0, < 7.1.0 6.5.7, 7.1.0
  46. Server crashes on invalid Cloud Function or Cloud Job name
    Kritisch · 9.0 CVE-2024-29027 < 6.5.5, >= 7.0.0-alpha.1, < 7.0.0-alpha.29 6.5.5, 7.0.0-alpha.29
  47. ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection
    Kritisch · 10.0 CVE-2024-27298 < 6.5.0, >= 7.0.0-alpha.1, < 7.0.0-alpha.20 6.5.0, 7.0.0-alpha.20
  48. Parse Server may crash when uploading file without extension
    Hoch · 7.5 CVE-2023-46119 >= 1.0.0, < 5.5.6, >= 6.0.0, < 6.3.1 5.5.6, 6.3.1
  49. Trigger `beforeFind` not invoked in internal query pipeline when fetching pointer
    Hoch · 7.5 CVE-2023-41058 >= 1.0.0, < 5.5.5, >= 6.0.0, < 6.2.2 5.5.5, 6.2.2
  50. Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
    Kritisch · 9.8 CVE-2023-36475 < 5.5.2, >= 6.0.0, < 6.2.1 5.5.2, 6.2.1
  51. Phishing attack vulnerability by uploading malicious HTML file dieser Eintrag
    Mittel · 6.3 CVE-2023-32689 < 5.4.4, >= 6.0.0, < 6.1.1 5.4.4, 6.1.1
  52. Parse Server option `masterKeyIps` vulnerability to IP spoofing
    Hoch · 8.7 CVE-2023-22474 < 5.4.1 5.4.1
  53. Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks
    Hoch · 7.2 CVE-2022-41879 < 4.10.20, >= 5.0.0, < 5.3.3 4.10.20, 5.3.3
  54. Parse Server vulnerable to Prototype Pollution via Cloud Code Webhooks or Cloud Code Triggers
    Hoch · 7.2 CVE-2022-41878 < 4.10.19, >= 5.0.0, < 5.3.2 4.10.19, 5.3.2
  55. Remote code execution via MongoDB BSON parser through prototype pollution
    Kritisch · 9.8 CVE-2022-39396 < 4.10.18, >= 5.0.0, < 5.3.1 4.10.18, 5.3.1
  56. parse-server crashes when receiving file download request with invalid byte range
    Hoch · 7.5 CVE-2022-39313 < 4.10.17, >= 5.0.0, < 5.2.8 4.10.17, 5.2.8
  57. Parse Server vulnerable to brute force guessing of user sensitive data via search patterns
    Hoch · 8.6 CVE-2022-36079 < 4.10.14, >= 5.0.0, < 5.2.5 4.10.14, 5.2.5
  58. Protected fields exposed via LiveQuery
    Hoch · 8.2 CVE-2022-31112 < 4.10.13, >= 5.0.0, < 5.2.4 4.10.13, 5.2.4
  59. Invalid file request can crash server
    Hoch · 7.5 CVE-2022-31089 < 4.10.12, >= 5.0.0, < 5.2.3 4.10.12, 5.2.3
  60. Authentication bypass vulnerability in Apple Game Center auth adapter
    Hoch · 8.6 CVE-2022-31083 < 4.10.11, >= 5.0.0, < 5.2.2 4.10.11, 5.2.2
  61. Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter
    Hoch · 7.5 CVE-2022-24901 < 4.10.10, >= 5.0.0, < 5.2.1 4.10.10, 5.2.1
  62. Command injection in Parse Server through prototype pollution
    Kritisch · 10.0 CVE-2022-24760 < 4.10.7 4.10.7
  63. LiveQuery publishes user session tokens in parse-server
    Hoch · 7.5 CVE-2021-41109 < 4.10.4 4.10.4
  64. Incorrect version tags linked to external repository
    Kritisch CVE-2021-47986 >= 4.0.0, < 4.5.2, >= 4.6.0, < 4.10.0 4.5.2, 4.10.0
  65. Parse Server crashes with query parameter
    Hoch · 7.5 CVE-2021-39187 < 4.10.3 4.10.3
  66. Information disclosure in parse-server
    Hoch · 7.7 CVE-2020-5251 < 4.1.0 4.1.0
  67. Parse Server before v3.4.1 vulnerable to Denial of Service
    Hoch · 7.5 CVE-2019-1020012 < 3.4.1 3.4.1

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden
DockRay Newsletter

Anwendungssicherheit in Ihrem Postfach

Wichtige Schwachstellen, konkrete Empfehlungen und praktische Tipps für Ihre Anwendungen. Wählen Sie Ihre Technologien und verfolgen Sie, was für Ihr Projekt relevant ist.

  • Eine tägliche Zusammenfassung neuer Schwachstellen, auch kritischer.
  • Benachrichtigungen über wichtige Updates.
  • Praktische Tipps zur Sicherheit und Überwachung von Anwendungen.

Leer lassen, um Meldungen zu allen Technologien zu erhalten.

Datenschutzerklärung

Kostenlos anmelden. In jeder E-Mail mit einem Klick abmelden.