Davimacedo

**Name of the Vulnerable Software and Affected Versions** Parse Server versions prior to 4.5.0 **Description** The issue involves the storage of user passwords in cleartext for LDAP authentication. This occurs in Parse Server when user passwords are not stripped after authentication, leading to cleartext password storage. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** For versions prior to 4.5.0, update to version 4.5.0 or later, which fixes the issue by stripping passwords after authentication to prevent cleartext password storage. As a temporary workaround, consider restricting access to LDAP authentication until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Parse Server versions 4.3.0 **Description** The issue allows clients with expired sessions to still receive subscription objects because Parse Server broadcasts events to all clients without checking if the session token is valid. It is not possible to create subscription objects with invalid session tokens. The problem arises from two caches in place for the session token: one at Parse Server level and one at Parse Live Query level. The cacheTTL option at Parse Server level has no effect over Live Query Server, and the cacheTimeout option at Live Query Server level also has no effect and actually defaults to 1 hour. **Recommendations** For Parse Server version 4.3.0, to resolve the issue, consider adjusting the cacheTTL option and liveQueryServerOptions.cacheTimeout to a lower value, such as 5 seconds, to minimize the time frame in which clients with expired sessions can receive subscription objects. Additionally, ensure that the Live Query Server properly checks for session validity to prevent unauthorized access. As a temporary workaround, consider implementing a mechanism to periodically check if the session exists and is valid for clients connected via Live Query Server.

**Name of the Vulnerable Software and Affected Versions** parser-server versions prior to 4.1.0 **Description** The issue allows fetching all user objects by utilizing regex in the NoSQL query, specifically targeting the sessionToken. This can be achieved through the API endpoint "/parse/users/me" by using a regex on the `sessionToken` variable, such as `" SessionToken":{"$regex":"r:027f"}`. Additionally, similar vulnerabilities exist in the verify email and request password reset functionalities, where an attacker can use regex in the token parameter to verify an account or reset a password, for example, by accessing the endpoint `http://localhost:1337/parse/apps/kickbox/verify email?token[$regex]=a&username=some@email.com` or `http://localhost:1337/parse/apps/kickbox/request password reset?token[$regex]=a&username=some@email.com`. This method enables retrieval of accounts without user interaction. **Recommendations** For parser-server versions prior to 4.1.0, update to version 4.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the NoSQL query functionality and limiting the use of regex on the `sessionToken` variable until a patch is applied. Additionally, restrict access to the verify email and request password reset endpoints to minimize the risk of exploitation.