PT-2021-23094 · Unknown · Parse Server

Dblythy · Published 2021-09-30 · Updated 2024-03-06 · CVE-2021-41109

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 4.10.4

Description The issue concerns the exposure of session tokens in LiveQuery payloads for users with a LiveQuery subscription on the Parse.User class. Normally, session tokens are removed from responses for regular queries, but this was not the case for LiveQuery payloads prior to the fix. This means all session tokens created during user sign-ups would be broadcast as part of the LiveQuery payload, potentially compromising user privacy. A patch in version 4.10.4 addresses this by removing session tokens from the LiveQuery payload.

Recommendations For versions prior to 4.10.4, update to version 4.10.4 or later to remove session tokens from LiveQuery payloads. As a temporary workaround for versions prior to 4.10.4, set user.acl(new Parse.ACL()) in a beforeSave trigger to make the user private already on sign-up.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-PARSE-2021-41109

CVE-2021-41109

GHSA-7PR3-P5FM-8R9X

Affected Products

Parse Server

References · 10

• https://github.com/parse-community/parse-server/commit/4ac4b7f71002ed4fbedbb901db1f6ed1e9ac5559 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41109 · Security Note
• https://osv.dev/vulnerability/GHSA-7pr3-p5fm-8r9x · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2021-41109 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41109 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/security/advisories/GHSA-7pr3-p5fm-8r9x · Note
• https://github.com/parse-community/parse-server/releases/tag/4.10.4 · Note
• https://t.me/cibsecurity/29722 · Telegram Post
• https://t.me/cvenotify/22131 · Telegram Post