ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection
ImpactThis vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database.PatchesThe algorithm to detect SQL injection has been improved.WorkaroundsNone.Referenceshttps://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2https://github.com/parse-community/parse-server/releases/tag/6.5.0 (fixed in Parse Server 6)https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20 (fixed in Parse Server 7 alpha release)CreditsMikhail Shcherbakov (https://twitter.com/yu5k3) working with Trend Micro Zero Day Initiative (finder)Ehsan Persania (remediation developer)Manuel Trezza (coordinator)