CyberRota Analysis
AI-GeneratedParse Server versions 9.0.0 to 9.10.0-alpha.2 and 8.6.83 are vulnerable to a stored cross-site scripting (XSS) attack due to improper handling of unrecognized file extensions, allowing malicious Content-Types to be stored and executed. This vulnerability can lead to the execution of embedded scripts in the context of the application, potentially compromising users who access the affected files. Organizations using these versions, particularly those utilizing storage adapters like Amazon S3 or Google Cloud Storage, should prioritize updating to the fixed versions to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Parse Server is affected by a stored cross-site scripting (XSS) vulnerability in versions >= 9.0.0, < 9.10.0-alpha.2 and <= 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid type/subtype media type (e.g., 'image', 'image/', or 'image//svg+xml') bypasses the fileUpload.fileExtensions blocklist and is stored unchanged. On storage adapters that persist and serve the uploaded Content-Type (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed value and falls back to MIME-sniffing; a file whose body begins with HTML is rendered as HTML, executing embedded script in the application's origin against other users who open the file URL. The default GridFS storage adapter is not affected. Fixed in 9.10.0-alpha.2 and 8.6.84.