PT-2020-18345 · Parse · Parse Server
Acinader
+1
·
Published
2020-03-04
·
Updated
2024-03-06
·
CVE-2020-5251
CVSS v3.1
7.7
High
| Vector | AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
parser-server versions prior to 4.1.0
Description
The issue allows fetching all user objects by utilizing regex in the NoSQL query, specifically targeting the sessionToken. This can be achieved through the API endpoint "/parse/users/me" by using a regex on the
sessionToken variable, such as " SessionToken":{"$regex":"r:027f"}. Additionally, similar vulnerabilities exist in the verify email and request password reset functionalities, where an attacker can use regex in the token parameter to verify an account or reset a password, for example, by accessing the endpoint http://localhost:1337/parse/apps/kickbox/verify email?token[$regex]=a&username=some@email.com or http://localhost:1337/parse/apps/kickbox/request password reset?token[$regex]=a&username=some@email.com. This method enables retrieval of accounts without user interaction.Recommendations
For parser-server versions prior to 4.1.0, update to version 4.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the NoSQL query functionality and limiting the use of regex on the
sessionToken variable until a patch is applied. Additionally, restrict access to the verify email and request password reset endpoints to minimize the risk of exploitation.Fix
Incorrect Authorization
Improper Authorization
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Parse Server