Connect with us
Categories:
X

Technology

Parse Server fixes brute-forcing bug that endangered sensitive user data at risk

Published

on

Parse Server fixes brute-forcing bug that endangered sensitive user data at risk
Share this post:

A security flaw in Parse Server that enabled brute-force guessing of sensitive user data on the API server module for Node.js and the Express WAF has been patched.

Parse Server is a popular open source project that provides push notification functionality for iOS, macOS, Android, and Apple TV operating system tvOS.

“Internal fields (keys used internally by Parse Server, prefixed by _) and protected fields (user defined) can be used as query constraints,” reads a description of the vulnerability in a GitHub advisory published on Friday (September 16).

“Internal and protected fields are removed by Parse Server from query results and are only returned to the client using a valid master key. However, using query constraints, these fields can be guessed by enumerating until Parse Server returns a response object.”

Tracked as CVE-2022-36079, the high severity issue was assigned a CVSS rating of 8.6 by GitHub but 7.5 by the National Institute of Standards and Technology (NIST). Attack complexity was deemed ‘low’.

Update and workaround

The bug was patched in versions 4.10.14 and 5.2.5 of the parse-server NPM package with all prior versions on these release lines affected. The fix mandates that the master key uses internal and protected fields as query constraints.

A workaround is also available for developers who are unable to update their systems immediately. “Implement a Parse Cloud Trigger beforeFind and manually remove the query constraints,” explained the advisory.

Other significant security bugs addressed in Parse Server this year include a high severity authentication bypass impacting Apple Game Center, disclosed in June, and a prototype pollution, maximum severity vulnerability disclosed in March that would “likely affect Postgres and any other database backend”.


Get More Stories Like This On: Facebook: @AllNaijaEntertainment, Twitter: @AllNaijaEntertainment
Cryptocurrency
Technology2 days ago

Meaning and Uses for Tether Crypto Explained

Bitcoin Cryptocurrency
Technology4 weeks ago

Have A Brief Idea About Bitcoin Mining And Its Operation

Mark Your Calendars For These 4 Premier Sporting Events Of 2023
Sports2 months ago

Mark Your Calendars For These 4 Premier Sporting Events Of 2023

How To Safeguard Your Crypto Wallet?
Technology2 months ago

How To Safeguard Your Crypto Wallet?

Angry youths chase Elumelu away as they disrupt PDP campaign in Delta
News2 months ago

Angry youths chase Elumelu away as they disrupt PDP campaign in Delta

Lai Mohammed
News2 months ago

FG recovers over N120bn from proceeds of crime – Lai Mohammed

News2 months ago

Tinubu says Peter Obi, Atiku lack track record to be president

Atiku Abubakar
News2 months ago

Plateau PDP set to receive Atiku

Peter Obi praises Gov Uzodimma’s leadership style
News2 months ago

Peter Obi praises Gov Uzodimma’s leadership style

Entertainment2 months ago

‘Free Mind’ by Tems enters 20th week on Billboard Hot 100

Kizz Daniel
Entertainment2 months ago

Buga by Kizz Daniel is the most searched song in Nigeria in 2022

News2 months ago

NJC Reinstates Justice Ofili-Ajumogobia As Judge Of Federal High Court

Man sentenced to 21 years in prison for stealing Lady Gaga's dogs
Entertainment2 months ago

Man sentenced to 21 years in prison for stealing Lady Gaga’s dogs

NNPC Ltd to disclose new asset base – Kyari
News2 months ago

Nigeria Records ₦‎16 Trillion Worth Of Crude Oil In 9 Months

Entertainment2 months ago

Broda Shaggi begs African fathers to hug their children

News2 months ago

Chatham House: APC slams Dele Momodu over comment on Tinubu

News2 months ago

Samuel Eto’o Apologises After Physically Attacking YouTuber

News2 months ago

N-Power Fraud: D’banj Arrested & Detained – ICPC Confirms, Releases Statement

News2 months ago

FG: Second Niger Bridge will open to traffic Dec 15

News2 months ago

2023 Polls Won’t Mar Nigeria – Sultan, CAN, SGF

Education2 months ago

ASUU Strike: CONUA threatens to sue FG over withheld salaries

Sports2 months ago

Eden Hazard announce retirement from international football

News2 months ago

2023: APC Has Failed Northerners, Muslim-Muslim Ticket Won’t Work – Shagari

News2 months ago

Teleprompters In Sight As Tinubu Spoke At Chatham House – Jaafar Shares Photo

Buhari
News2 months ago

2023: No manipulations of any form will be allowed, Buhari vows

News2 months ago

Kano Hisbah to destroy 18,000 bottles of beer

Entertainment2 months ago

Emancipation: Will Smith pulls you in with gritty realities of slavery era[Review]

Will Smith hopes ‘brutal’ depictions of slavery in Emancipation are ‘not in vain’, as he attends premiere in London
Entertainment2 months ago

I became more alive by facing my pain – Will Smith

Luis Enrique
Sports2 months ago

Spain manager full of praise for his players despite shock Morocco loss

Goncalo Ramos
Sports2 months ago

Goncalo Ramos reacts after taking Cristiano Ronaldo’s place in Portugal team

Frank Leboeuf
Sports2 months ago

Frank Leboeuf aims bizarre dig at Kieran Trippier

Sports2 months ago

Can the Three Lions outsmart France’s unstoppable star player?

Horoscope2 months ago

Your daily horoscope for Wednesday, December 7, 2022

Sports2 months ago

FIFA World Cup 2022: Goncalo Ramos nets first hat-trick of 2022 FIFA World Cup as Portugal trash Switzerland

Sports2 months ago

FIFA World Cup 2022: Yassine Bono the hero as Morocco knocks Spain out of World Cup

Godwin Emefiele
News2 months ago

CBN Drops ATM Withdrawal Limit To ₦‎20k/Day

TikTok logo
News2 months ago

‘TikTok Challenge’ Circulates Info-Stealing Malware – NCC

DOWNLOAD Complete Wednesday (TV series) (2022 film) Season 1 Subtitles File [English SRT] 2022
Movie Subtitle2 months ago

DOWNLOAD Complete Wednesday (TV series) (2022 film) Season 1 Subtitles File [English SRT] 2022

The vast network of antennas will form the world’s largest radio telescope
Technology2 months ago

The largest radio telescope in the world’s construction gets underway

News2 months ago

FG releases new curriculum for universities in Nigeria

ANE Billboard Hots