GHSA-2rxj-6v32-2v6j: 
JavaScript vulnerability analysis and mitigation

Impact

A client update of an object in a class with a beforeSave trigger can terminate the Parse Server process, a denial of service for all clients until the server restarts. The update uses a dot notation key below a field whose stored value is not a plain object, including the timestamps every object carries, so no particular field is required. No authentication is needed when the object is writable with the client key, and any signed-up user can target their own user object when the user class has a beforeSave trigger. Classes without a beforeSave trigger are not affected.

Patches

A failure to serialize the object after the beforeSave trigger now rejects the request with an invalid type error instead of leaving it unsettled, and a failure while settling any trigger result is contained the same way.

Workarounds

Reject dot notation keys below non-object fields, including the timestamps and the ACL, with the requestKeywordDenylist option on classes that have a beforeSave trigger, or remove beforeSave triggers from affected classes. Upgrading is the recommended remediation.

References

• GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-2rxj-6v32-2v6j
• Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10864
• Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10865