Skip to main content

Server-Side Request Forgery (SSRF)

CVE-2025-64430

High
7.5/10

Summary

A Server-Side Request Forgery (SSRF) vulnerability in parse-server in the file upload functionality when trying to upload a "Parse.File" with the "uri" parameter allows to execute an arbitrary URI. The vulnerability stems from a file upload feature in which Parse Server retrieves the file data from a URI that is provided in the request. A request to the provided URI is executed, but the response is not stored in Parse Server's file storage as the server crashes upon receiving the response. This issue affects versions 4.2.0 through 7.5.3 and 8.x versions through 8.4.0-alpha.1.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-918 - Server-Side Request Forgery (SSRF)

Server-side request forgery (SSRF) is a weakness that allows an attacker to send an arbitrary request, making it appear that the request was sent by the server. This request may bypass a firewall that would normally prevent direct access to the URL. The impact of this vulnerability can vary from unauthorized access to files and sensitive information to remote code execution.

References

Advisory Timeline

  • Published