CVE-2025-64502: Parse Server Information Disclosure Flaw

CVE-2025-64502 Overview

CVE-2025-64502 is an information disclosure vulnerability in Parse Server, an open source Node.js backend framework. Parse Server versions prior to 8.5.0-alpha.5 allow any client to execute MongoDB explain() queries without requiring the master key. The explain() method returns query execution plans, index configurations, collection scanning behavior, and performance metrics. Attackers can enumerate database schema structure, field names, and index details, and gather intelligence to craft performance-based attacks. The flaw is tracked as CWE-201: Insertion of Sensitive Information Into Sent Data.

Critical Impact
Unauthenticated network attackers can query internal database schema, indexes, and execution statistics from any Parse Server deployment prior to the patched release.

Affected Products

Parse Server versions prior to 8.5.0-alpha.5
Deployments using the MongoDB storage adapter
Any Parse Server instance exposing the query API to untrusted clients

Discovery Timeline

2025-11-10 - CVE-2025-64502 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64502

Vulnerability Analysis

Parse Server exposes the Parse.Query.explain() API to clients over its query endpoint. Before the fix, the server forwarded these requests to the underlying MongoDB driver without checking whether the caller possessed the master key. MongoDB's explain() returns the full query planner output, including winningPlan, rejectedPlans, index bounds, and execution statistics. This data reveals internal collection layout, field naming conventions, and which indexes back which queries. Attackers can also use explain output to identify expensive queries and craft algorithmic denial-of-service payloads that trigger full collection scans.

Root Cause

The MongoDB storage adapter in src/Adapters/Storage/Mongo/MongoStorageAdapter.js accepted the explain flag from client queries without gating it behind master-key authentication. There was no configuration switch to restrict access, so every deployment inherited public explain behavior by default. The fix introduces a new databaseOptions.allowPublicExplain option validated in src/Config.js.

Attack Vector

An unauthenticated remote attacker sends a normal Parse REST or SDK query with the explain parameter set to true. The server executes the query and returns the MongoDB planner and executor output instead of the usual document results. Repeated calls across multiple classes let the attacker map the entire schema and index topology.

javascript

// Patched validation in src/Config.js
// Source: https://github.com/parse-community/parse-server/commit/4456b02280c2d8dd58b7250e9e67f1a8647b3452
} else if (typeof databaseOptions.schemaCacheTtl !== 'number') {
  throw `databaseOptions.schemaCacheTtl must be a number`;
}
if (databaseOptions.allowPublicExplain === undefined) {
  databaseOptions.allowPublicExplain = DatabaseOptions.allowPublicExplain.default;
} else if (typeof databaseOptions.allowPublicExplain !== 'boolean') {
  throw `Parse Server option 'databaseOptions.allowPublicExplain' must be a boolean.`;
}

The patch adds a boolean option that maintainers can toggle to require master-key authentication for explain queries. See the GitHub Pull Request #9890 for the complete change set.

Detection Methods for CVE-2025-64502

Indicators of Compromise

HTTP requests to Parse Server query endpoints containing the explain=true parameter or _method payloads with "explain": true
Response payloads containing MongoDB planner fields such as queryPlanner, winningPlan, executionStats, or stage
Repeated explain queries across multiple Parse classes from a single client IP without a master key header

Detection Strategies

Inspect Parse Server access logs for X-Parse-Master-Key absence combined with explain query parameters
Deploy web application firewall rules that flag or block query bodies containing "explain":true from non-privileged clients
Watch for the Parse Server security warning that logs when allowPublicExplain is not explicitly set on version 8.5.0-alpha.5 or later

Monitoring Recommendations

Forward Parse Server logs to a centralized log platform and alert on spikes in explain request volume
Correlate explain requests with database slow-query logs to identify reconnaissance leading to scan-heavy queries
Track outbound API response sizes for query endpoints; explain responses are structurally distinct from normal document results

How to Mitigate CVE-2025-64502

Immediate Actions Required

Upgrade Parse Server to version 8.5.0-alpha.5 or later and explicitly set databaseOptions.allowPublicExplain to false
Audit application code and third-party clients for legitimate explain usage before disabling public access
Rotate any credentials or tokens that may have been exposed through schema reconnaissance

Patch Information

The fix is available in Parse Server 8.5.0-alpha.5 via GitHub commit 4456b022. Full advisory details are published in GHSA-7cx5-254x-cgrq. The allowPublicExplain option defaults to true in this release to preserve backward compatibility, but the maintainers plan to change the default to false in a future major release.

Workarounds

Implement Express middleware in front of Parse Server that rejects request bodies or query strings containing explain unless the X-Parse-Master-Key header is present
Restrict Parse Server query endpoints to internal networks or authenticated clients using a reverse proxy
Enable alerting on explain query usage in production so anomalous access is investigated

bash

# Parse Server configuration to restrict explain to master key
export PARSE_SERVER_DATABASE_OPTIONS='{"allowPublicExplain": false}'

# Or in code:
# const server = new ParseServer({
#   databaseURI: 'mongodb://...',
#   databaseOptions: { allowPublicExplain: false },
#   ...
# });