Attack Chain

1. The attacker identifies an internet-facing Parse Server deployment exposing the REST API.
2. The attacker uses the public application ID to target the specific instance.
3. The attacker constructs a malicious HTTP request targeting the installation deduplication endpoint.
4. The attacker provides non-string data (e.g., JSON objects containing query operators like '$ne' or '$in') within the device token installation fields.
5. The Parse Server backend receives the request and triggers the deduplication cleanup logic.
6. The database driver interprets the injected query operators due to improper type validation.
7. The system executes the modified query with elevated, administrative-level privileges, bypassing class-level permission checks.
8. The database performs an unauthorized delete operation, purging targeted device registration records and disabling push notifications.

Impact

The successful exploitation of this vulnerability results in the permanent loss of device registration records for the affected Parse Server application. This leads to a total service outage for push notification functionality across the targeted installation. Because the records are deleted from the database without server-side backups available for restoration, legitimate users must manually re-register their devices to regain push notification services. This vulnerability affects all deployments that expose the REST API and utilize push notifications in their default configuration.

Recommendation

1. Upgrade Parse Server to version 8.6.90 or 9.10.1-alpha.9 immediately to incorporate the required input type validation and cleanup scoping.
2. Audit web server logs for HTTP requests directed at installation endpoints that contain non-string data or unconventional JSON structures in installation fields, as these may indicate exploitation attempts.
3. Implement strict API gateway-level validation or WAF rules to reject requests containing non-string data types in fields expected to be strictly string-based.