Parse Server Vulnerable a Server-Side Request Forgery (SSRF) en la Carga de Archivos a través de Formato URI

The SSRF vulnerability in Parse Server arises from the way it handles file uploads with a uri parameter. When a user attempts to upload a Parse.File specifying a URI, Parse Server attempts to retrieve the file data from that URI. Critically, the response from this external URI is not properly handled, causing the server to crash. While the server doesn't store the response, the attacker can still trigger requests to internal or external resources, potentially accessing sensitive data or interacting with other systems. This could lead to information disclosure, privilege escalation, or even remote code execution depending on the targeted URI and the server's configuration. The crash itself can also be used as a denial-of-service vector.

Organizations using Parse Server for backend services, particularly those handling sensitive data or integrating with internal systems, are at risk. Deployments relying on file upload functionality and those with less stringent URI validation are especially vulnerable. Shared hosting environments using Parse Server may also be affected.

• nodejs / server: Monitor Parse Server logs for outbound requests to unexpected or unauthorized URIs. Use journalctl to filter for errors related to file uploads and URI processing.

journalctl -u parse-server --grep 'uri' --grep 'error'

• generic web: Use curl or wget to check for exposed endpoints related to file uploads and observe the responses for signs of SSRF activity.

curl -v 'https://your-parse-server/files/upload?uri=http://internal-system/'

1. 2025-11-05Disclosure

   disclosure

1. Reservado2025-11-03
2. Publicada2025-11-05
3. Modificada2025-11-12
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-64430 is to upgrade Parse Server to version 7.5.4 or later, which includes the necessary fix. If upgrading immediately is not feasible, consider implementing temporary workarounds. One approach is to restrict the allowed URIs for file uploads, limiting them to trusted domains. Additionally, implement strict input validation to prevent attackers from injecting malicious URIs. Web Application Firewalls (WAFs) can be configured to block requests containing suspicious URI patterns. Monitor Parse Server logs for unusual outbound requests that might indicate exploitation attempts.