PT-2020-14328 · Parse · Parse Server

Davimacedo · Published 2020-10-22 · Updated 2024-03-06 · CVE-2020-15270

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Parse Server versions 4.3.0

Description The issue allows clients with expired sessions to still receive subscription objects because Parse Server broadcasts events to all clients without checking if the session token is valid. It is not possible to create subscription objects with invalid session tokens. The problem arises from two caches in place for the session token: one at Parse Server level and one at Parse Live Query level. The cacheTTL option at Parse Server level has no effect over Live Query Server, and the cacheTimeout option at Live Query Server level also has no effect and actually defaults to 1 hour.

Recommendations For Parse Server version 4.3.0, to resolve the issue, consider adjusting the cacheTTL option and liveQueryServerOptions.cacheTimeout to a lower value, such as 5 seconds, to minimize the time frame in which clients with expired sessions can receive subscription objects. Additionally, ensure that the Live Query Server properly checks for session validity to prevent unauthorized access. As a temporary workaround, consider implementing a mechanism to periodically check if the session exists and is valid for clients connected via Live Query Server.

Fix

Weakness Enumeration

CWE-672

Related Identifiers

BIT-PARSE-2020-15270

CVE-2020-15270

GHSA-2XM2-XJ2Q-QGPJ

Affected Products

Parse Server

References · 9

• https://github.com/parse-community/parse-server/commit/78b59fb26b1c36e3cdbd42ba9fec025003267f58 · Patch
• https://osv.dev/vulnerability/CVE-2020-15270 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15270 · Security Note
• https://osv.dev/vulnerability/BIT-parse-2020-15270 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2xm2-xj2q-qgpj · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/security/advisories/GHSA-2xm2-xj2q-qgpj · Note
• https://t.me/cibsecurity/15542 · Telegram Post
• https://npmjs.com/parse-server · Note