parse-server email validation regex denial of service (ReDoS)
A sign-up request can freeze Parse Server, an app backend.
Summary
A regular expression that checks email addresses in parse-server can freeze the server from one long sign-up request. Unauthenticated attackers who know the application ID can do this, affecting deployments that allow user sign-up.
Affected when
- Deployments that allow user sign-up (the default)
What to do
Update to parse-server 9.10.7-alpha.1 or 8.6.115. Until then, add a Cloud Code beforeSave trigger on the _User class that rejects emails longer than 254 characters.
Update to at least the version for your product:
- parse-server 9 9.10.7-alpha.1 or later
- parse-server 8 8.6.115 or later
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab)
- Write-up: vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen