A vulnerability in Parse Server allows authenticated attackers to perform stored Cross-site Scripting (XSS) attacks by bypassing file extension filters during the upload process.

The application fails to properly sanitize the Content-Type header during file uploads, allowing an authenticated attacker to append MIME parameters to bypass blocklist validation. This enables the storage of malicious files containing active content, which can then execute in the context of a user's browser.

Successful exploitation of this stored XSS vulnerability could lead to the theft of sensitive session tokens, user credentials, or other data stored in the browser's local storage. Given the CVSS score of 7.6, this represents a high-severity risk to application integrity and user privacy. Organizations relying on Parse Server for backend services may face significant reputational damage if user accounts are compromised through malicious script injection.

Immediate Action: Update Parse Server to version 9.6.0-alpha.15 or 8.6.41, which includes the fix to strip MIME parameters from headers and expands the default file extension blocklist.

Proactive Monitoring: Review application logs for unusual file upload activity, particularly requests containing non-standard characters or unexpected parameters in the Content-Type header.

Compensating Controls: Implement a strict allowlist for file extensions using the fileUpload.fileExtensions configuration option to limit the types of files users can upload, rather than relying solely on blocklists.

Public Exploit Available: No (exploit_available: unknown)

Administrators should prioritize upgrading Parse Server to the provided patched versions immediately to eliminate the risk of stored XSS attacks. If an immediate upgrade is not feasible, ensure that the fileUpload.fileExtensions option is configured as a restrictive allowlist to prevent the upload of risky file types until the patch can be applied.