Executive brief
A security flaw was identified in Parse Server, an open-source backend framework used to build and host applications. An authenticated user could exploit this vulnerability to bypass security restrictions and view sensitive data belonging to their own user profile and related records that should normally be protected. This could lead to unauthorized access to private user information and linked data within the application's database.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in Parse Server's GraphQL 'viewer' query. Authenticated users can bypass read security constraints on their own User object, as well as any objects linked via Relations or Pointers. This allows a low-privileged user to access data they are not authorized to view by exploiting the logic within the GraphQL loaders. The issue affects versions 3.5.0 through 4.2.x and is resolved in version 4.3.0.
Affected products
- Parse Platform parse-server >= 3.5.0, < 4.3.0
Timeline
- 2020-07-22: disclosed
- 2020-07-22: advisory
- 2020-07-22: patched: Fixed in version 4.3.0