Parse Server 存在通过 PostgreSQL 中嵌套对象字段的 `Increment` 操作进行 (SQL Injection (SQL 注入)) 的漏洞

该 SQL 注入漏洞允许攻击者通过构造恶意的 SQL 子查询，读取 PostgreSQL 数据库中的任意数据。由于缺乏参数化和类型验证，攻击者可以绕过客户端策略 (CLP) 和访问控制列表 (ACL) 机制，获取未经授权的数据访问权限。攻击者可能利用此漏洞窃取用户数据、配置信息或其他敏感数据。由于 Parse Server 广泛应用于移动后端服务，该漏洞的潜在影响范围非常广泛，可能导致大规模数据泄露和系统安全事件。该漏洞的严重程度与 Log4Shell 类似，需要高度重视。

Organizations and developers using Parse Server for backend-as-a-service (BaaS) applications, particularly those relying on PostgreSQL for data storage, are at risk. Deployments with less stringent input validation or weaker access control policies are especially vulnerable. Shared hosting environments where multiple applications share the same Parse Server instance could also be affected, potentially impacting multiple tenants.

• nodejs / server: Monitor Parse Server logs for unusual SQL query patterns, particularly those involving dot notation in nested object fields. Look for queries containing SQL keywords or functions that are not expected in legitimate Increment operations.

grep -i 'SELECT|INSERT|UPDATE|DELETE' /var/log/parse-server.log

• database (postgresql): Review PostgreSQL audit logs for suspicious SQL queries originating from the Parse Server application. Look for queries that bypass access controls or attempt to access sensitive data.

SELECT query FROM pg_stat_activity WHERE datname = 'your_database_name';

• generic web: If Parse Server is exposed via a web interface, attempt to send Increment requests with non-numeric values in the amount field and monitor the server's response for error messages or unexpected behavior.

1. 2026-03-11Disclosure

   disclosure

1. 已保留2026-03-09
2. 发布日期2026-03-11
3. 修改日期2026-03-13
4. EPSS 更新日期2026-03-23

为了缓解 CVE-2026-31856 漏洞，首要措施是立即升级 Parse Server 至 9.6.0-alpha.3 或更高版本。如果无法立即升级，可以考虑以下临时缓解措施：限制 Parse Server REST API 的访问权限，仅允许授权用户进行写入操作；实施严格的输入验证和过滤，防止恶意 SQL 代码注入；监控 Parse Server 的数据库日志，检测异常的 SQL 查询活动。升级后，请验证数据库配置是否正确，并确认 SQL 注入漏洞已成功修复。