CVE-2025-64502 in parse-server
Summary
by MITRE • 11/11/2025
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB `explain()` method provides detailed information about query execution plans, including index usage, collection scanning behavior, and performance metrics. Prior to version 8.5.0-alpha.5, Parse Server permits any client to execute explain queries without requiring the master key. This exposes database schema structure and field names, index configurations and query optimization details, query execution statistics and performance metrics, and potential attack vectors for database performance exploitation. In version 8.5.0-alpha.5, a new `databaseOptions.allowPublicExplain` configuration option has been introduced that allows to restrict `explain` queries to the master key. The option defaults to `true` for now to avoid a breaking change in production systems that depends on public `explain` availability. In addition, a security warning is logged when the option is not explicitly set, or set to `true`. In a future major release of Parse Server, the default will change to `false`. As a workaround, implement middleware to block explain queries from non-master-key requests, or monitor and alert on explain query usage in production environments.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/11/2025
The vulnerability described in CVE-2025-64502 affects Parse Server versions prior to 8.5.0-alpha.5, representing a critical security flaw that exposes sensitive database metadata to unauthorized clients. This issue stems from the improper access control mechanism surrounding the MongoDB explain() method, which is designed to provide detailed insights into query execution plans including index usage patterns, collection scanning behavior, and performance metrics. The vulnerability allows any client to execute explain queries without requiring the master key authentication, creating a significant information disclosure risk that could enable attackers to gain comprehensive knowledge of the underlying database schema structure, field names, and indexing configurations.
The technical flaw manifests in the lack of proper authorization checks for the explain functionality within Parse Server's database layer. This oversight creates a direct pathway for malicious actors to extract detailed query execution statistics and performance metrics from the MongoDB backend, potentially revealing critical information about database optimization strategies and query patterns. The exposure of such metadata provides attackers with valuable intelligence for crafting more sophisticated attacks, including understanding index configurations that could be exploited for performance degradation attacks or identifying potential query optimization vulnerabilities. According to CWE-284, this represents an improper access control vulnerability where insufficient authorization checks allow unauthorized access to sensitive database operations that should be restricted to administrative users.
The operational impact of this vulnerability extends beyond simple information disclosure, as it creates potential attack vectors for database performance exploitation and schema reconnaissance. Attackers could leverage the exposed query execution details to identify inefficient queries, understand database access patterns, and potentially construct attacks that degrade system performance through resource exhaustion or by targeting specific query optimization weaknesses. The exposure of index configurations and field names enables more targeted attacks against the database infrastructure, while the performance metrics could be used to identify system bottlenecks and optimize attack strategies. This vulnerability aligns with ATT&CK technique T1069.001 for credential access and T1595.001 for reconnaissance, as it provides attackers with essential information for further system exploration and targeted attacks.
Parse Server version 8.5.0-alpha.5 introduced a configuration option called databaseOptions.allowPublicExplain to address this vulnerability, providing administrators with granular control over explain query access. The default setting of true was implemented to avoid breaking existing production systems that may depend on public explain availability, but this approach creates a security risk that will be addressed in future major releases where the default will change to false. The implementation includes security warnings when the option is not explicitly set or when set to true, encouraging administrators to explicitly configure this security parameter. Organizations should implement middleware solutions to block explain queries from non-master-key requests as a temporary workaround, while also establishing monitoring and alerting mechanisms to track explain query usage in production environments. This approach aligns with security best practices outlined in the OWASP Top Ten and follows the principle of least privilege by restricting access to sensitive database diagnostic information to authorized administrative users only.