Parse Server stores password in plain text

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication to preven...

PT-2020-16406 · Parse · Parse Server

Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 4.5.0 Description: The issue involves the storage of user passwords in cleartext for LDAP authentication. This occurs in Parse Server when user passwords are not stripped after authentication, leading to clearte...

receiving subscription objects with deleted session

Original Message: Hi, I create objects with one client with an ACL of all users with a specific column value. Thats working so far. Then I deleted the session object from one user to look if he can receive subscription objects and he can receive them. The client with the deleted session cant crea...

GHSA-2XM2-XJ2Q-QGPJ receiving subscription objects with deleted session

Original Message: Hi, I create objects with one client with an ACL of all users with a specific column value. Thats working so far. Then I deleted the session object from one user to look if he can receive subscription objects and he can receive them. The client with the deleted session cant crea...

Token Validation Bypass

parse-server is vulnerable to token validation bypass. Lack of checking deleted sessions after the websocket connection was established allows clients with invalid session tokens to still receive subscription object...

CVE-2020-15270

Parse Server npm package parse-server broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not...

CVE-2020-15270

Parse Server npm package parse-server broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not...

Design/Logic Flaw

Parse Server npm package parse-server broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not...

CVE-2020-15270 Improper session expiration in Parse Server

Parse Server npm package parse-server broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not...

CVE-2020-15270

Parse Server (parse-server) Vulnerability CVE-2020-15270: the Live Query mechanism allowed broadcasting subscription objects to clients with invalid/expired sessions because the session token validation was not enforced after the WebSocket connection was established. The issue is described in mul...

PT-2020-14328 · Parse · Parse Server

Name of the Vulnerable Software and Affected Versions: Parse Server versions 4.3.0 Description: The issue allows clients with expired sessions to still receive subscription objects because Parse Server broadcasts events to all clients without checking if the session token is valid. It is not...

GHSA-WVH7-5P38-2QFC Storing Password in Local Storage

The setPassword method http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.htmlsetPassword stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time that password is stored at all. In the...

Authorization Bypass

parse-server is vulnerable to authorization bypass. The vulnerability exists in the GraphQL viewer where an authenticated user can bypass the read security restrictions, and all objects linked through relation, placed on his User object...

GraphQL: Security breach on Viewer query

Impact An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object. Patches This vulnerability has been patched in Parse Server 4.3.0. Workarounds No References See commit...

@bigegg/parse-server-schema-config (>=1.0.5, <=1.0.10), sails-hook-parse-server (>=1.0.0, <=1.1.0) potentially affected by CVE-2020-15126 via parse-server (3.10.0)

parse-server NPM version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-server and may be impacted: - @bigegg/parse-server-schema-config =1.0.5, =1.0.0, =1.1.0 Source cves: CVE-2020-15126 Source advisory: OSV:GHSA-236H-RQV8-8Q73...

GHSA-236H-RQV8-8Q73 GraphQL: Security breach on Viewer query

Impact An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object. Patches This vulnerability has been patched in Parse Server 4.3.0. Workarounds No References See commit...

@0x18b2ee/parse-server (>=3.10.1, <=3.11.0), @adncorp/parse-server (>=2.0.0, <=2.10.4) +126 more potentially affected by unknown CVE via apollo-server-express (>=2.0.0, <=2.14.1)

apollo-server-express NPM version =2.0.0, =3.10.1, =2.0.0, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =0.5.2-dev1, =2018.8.28-0, =1.0.5, =3.9.0, =1.0.3, =1.2.7 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

Information Disclosure

parse-server is vulnerable to information disclosure. An insecure regular expression parsing of the sessionToken and token$regex variables allows an attacker to discover and retrieve valid accounts, or verify and reset another user's account...

Information disclosure in parse-server

you can fetch all the users' objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken "SessionToken":"$regex":"r:027f" and find valid accounts this way. Using this method, it's possible to retrieve accounts without interaction from the users. GET...

GHSA-H4MF-75HF-67W4 Information disclosure in parse-server

you can fetch all the users' objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken "SessionToken":"$regex":"r:027f" and find valid accounts this way. Using this method, it's possible to retrieve accounts without interaction from the users. GET...