Threats tagged 'ghsa-r899-h629-j84r'

Parse Server versions prior to 9.10.0-alpha.2 and 8.6.84 are vulnerable to a stored cross-site scripting (XSS) issue via malformed Content-Type headers in file uploads. The vulnerability arises because malformed Content-Type values that do not conform to the type/subtype format can bypass the file extension blocklist and be stored unchanged. When served from storage adapters that preserve the Content-Type header (e.g., Amazon S3, Google Cloud Storage, Azure Blob Storage), browsers may MIME-sniff the file content and execute embedded scripts, leading to stored XSS. The default GridFS adapter is not affected due to recomputing Content-Type and using X-Content-Type-Options: nosniff. Patches are available that validate Content-Type headers for well-formedness and reject malformed values.