A critical Server-Side Request Forgery vulnerability in Parse Server allows unauthenticated attackers to cause a denial-of-service condition, necessitating an immediate update.

This is a Server-Side Request Forgery (CWE-918) vulnerability located within the file upload feature. An unauthenticated attacker can supply a malicious URI via the Parse.File parameter, forcing the server to perform an outbound request that results in a crash.

Successful exploitation of this flaw leads to a denial-of-service condition, rendering the backend infrastructure unavailable. With a CVSS score of 7.5, this high-severity vulnerability poses a significant risk to service continuity for applications relying on Parse Server, potentially disrupting critical business operations and requiring emergency maintenance.

Immediate Action: Upgrade Parse Server to version 7.5.4 or 8.4.0-alpha.2 to incorporate the provided security fix.

Proactive Monitoring: Review application and network logs for unusual outbound requests originating from the Parse Server, particularly those targeting internal infrastructure or unexpected external domains.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block suspicious URI parameters in file upload requests.

Public Exploit Available: No (exploit_available: unknown)

Given the ease of exploitation and the potential for service disruption, organizations running vulnerable versions of Parse Server must prioritize patching. Update the underlying npm package to the specified fixed versions immediately to eliminate the SSRF vector and restore system stability.