GHSA-x4qj-2f4q-r4rx
Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format
At a glance
- Published
- Updated
- CVE
- CVE-2025-64430
- Aliases
- BIT-parse-2025-64430
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
### Impact A Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality when trying to upload a `Parse.File` with `uri` parameter allows to execute an arbitrary URI. The vulnerability stems from a file upload feature in which Parse Server retrieves the file data from a URI that is provided in the request. A request to the provided URI is executed, but the response is not stored in Parse Server's file storage as the server crashes upon receiving the response. ### Patches The feature has been implemented in Parse Server 4.2.0 but never worked and reliably crashes the server when trying to use it due to a bug in its implementation. Since the feature is not currently working, and due to its risky nature, it has been removed to address the vulnerability. ### Workarounds None.
Affected packages
| Package | Versions |
|---|---|
| npm · parse-server | introduced 4.2.0, fixed 7.5.4 |
| npm · parse-server | introduced 8.0.0, fixed 8.4.0-alpha.2 |
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-x4qj-2f4q-r4rx WEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-64430 ADVISORY
- https://github.com/parse-community/parse-server/pull/9903 WEB
- https://github.com/parse-community/parse-server/pull/9904 WEB
- https://github.com/parse-community/parse-server/commit/8bbe3efbcf4a3b66f4a8db9bfb18cd98c050db51 WEB
- https://github.com/parse-community/parse-server/commit/97763863b72689a29ad7a311dfb590c3e3c50585 WEB
- https://github.com/parse-community/parse-server PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |