Executive brief
Parse Server is an open-source backend framework used to power mobile and web applications. A security issue in its real-time 'Live Query' feature allowed users with expired or deleted sessions to continue receiving private data updates they should no longer have access to. This could lead to unauthorized data exposure if a user's access is revoked but their connection remains active.
Technical details
A vulnerability in Parse Server's LiveQueryServer component allows clients to continue receiving event broadcasts even after their session token has been invalidated or deleted. The root cause is a discrepancy between session cache TTLs; while the main Parse Server defaults to 5 seconds, the Live Query Server cache was defaulting to 30 days (or 1 hour in practice) and failing to respect the global cache settings. An attacker with a previously valid session can maintain a WebSocket connection and receive real-time updates for objects they are no longer authorized to view. The issue is resolved in version 4.4.0 by synchronizing cache timeouts and reducing the default Live Query cache duration to 5 seconds.
Affected products
- Parse Community parse-server <= 4.3.0
Timeline
- 2020-10-21: patched: Fix committed to repository
- 2020-10-22: advisory: GitHub Security Advisory published
- 2020-10-22: disclosed: NVD publication date