CVE-2023-32689

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 5.4.4 and 6.1.1 are vulnerable to a phishing attack vulnerability that involves a user uploading malicious files. A malicious user could upload an HTML file to Parse Server via its public API. That HTML file would then be accessible at the internet domain at which Parse Server is hosted. The URL of the the uploaded HTML could be shared for phishing attacks. The HTML page may seem legitimate because it is served under the internet domain where Parse Server is hosted, which may be the same as a company's official website domain. An additional security issue arises when the Parse JavaScript SDK is used. The SDK stores sessions in the internet browser's local storage, which usually restricts data access depending on the internet domain. A malicious HTML file could contain a script that retrieves the user's session token from local storage and then share it with the attacker. The fix included in versions 5.4.4 and 6.1.1 adds a new Parse Server option `fileUpload.fileExtensions` to restrict file upload on Parse Server by file extension. It is recommended to restrict file upload for HTML file extensions, which this fix disables by default. If an app requires upload of files with HTML file extensions, the option can be set to `['.*']` or another custom value to override the default.

• CWE-434
• CWE-434

• https://github.com/parse-community/parse-server/pull/8537Patch
• https://github.com/parse-community/parse-server/pull/8538Patch
• https://github.com/parse-community/parse-server/security/advisories/GHSA-9prm-jqwx-45x9Vendor Advisory
• https://github.com/parse-community/parse-server/pull/8537Patch
• https://github.com/parse-community/parse-server/pull/8538Patch
• https://github.com/parse-community/parse-server/security/advisories/GHSA-9prm-jqwx-45x9Vendor Advisory

Published

May 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-32683Synapse is a Matrix protocol homeserver written in Python wi…5.4
• CVE-2023-32684Lima launches Linux virtual machines, typically on macOS, fo…2.5
• CVE-2023-32685Kanboard is project management software that focuses on the …5.4
• CVE-2023-32686Kiwi TCMS is an open source test management system for both …5.4
• CVE-2023-32687tgstation-server is a toolset to manage production BYOND ser…6.5
• CVE-2023-32688parse-server-push-adapter is the official Push Notification …7.5
• CVE-2023-3269A vulnerability exists in the memory management subsystem of…7.8
• CVE-2023-32690libspdm is a sample implementation that follows the DMTF SPD…7.5
• CVE-2023-32691gost (GO Simple Tunnel) is a simple tunnel written in golang…5.9
• CVE-2023-32692CodeIgniter is a PHP full-stack web framework. This vulnerab…9.8
• CVE-2023-32693Decidim is a participatory democracy framework, written in R…6.1
• CVE-2023-32694Saleor Core is a composable, headless commerce API. Saleor's…5.4