Description

Parse Dashboard has incomplete authentication on AI Agent endpoint

Impact

The AI Agent API endpoint (POST /apps/:appId/agent) lacks authentication. Unauthenticated remote attackers can send requests to the endpoint and perform arbitrary database operations against any connected Parse Server using the master key.

Patches

The fix adds authentication middleware to the agent endpoint.

Workarounds

Remove the agent configuration block from your dashboard configuration. Dashboards without an agent config are not affected.

Resources

GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-qwc3-h9mg-4582

Fixed in: https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8

Mitigation

Aliases

References