Executive brief
Parse Server is a backend platform used by developers to power web and mobile applications. When LDAP (directory service) authentication is configured, user passwords are stored in plaintext in the database instead of being securely hashed or encrypted. This allows anyone with database access—including a compromised employee or attacker who gains access to the server—to read all user passwords directly and potentially compromise user accounts.
Technical details
Parse Server before version 4.5.0 fails to strip user passwords after successful LDAP authentication, causing plaintext password storage in the database within the user's authData field. The vulnerability is classified as CWE-312 (Cleartext Storage of Sensitive Information). An authenticated attacker with database access can query the _User collection and retrieve plaintext LDAP passwords directly. The attack requires internal database access but no network exploitation; it represents a credential compromise risk if the Parse Server database is breached. The fix, implemented in commit da905a3 and released in version 4.5.0, strips the password field from the authData object after authentication succeeds, preventing plaintext storage while maintaining LDAP functionality.
Affected products
- Parse Community Parse Server <4.5.0
Timeline
- 2020-12-02: disclosed
- 2020-12-15: patched: Fixed in version 4.5.0
- 2020-12-28: advisory
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-4w46-w44m-3jq3
- https://github.com/parse-community/parse-server/commit/da905a357d062ab4fea727a21eac231acc2ed92a
- https://github.com/parse-community/parse-server/releases/tag/4.5.0
- https://www.npmjs.com/advisories/1593
- https://www.npmjs.com/package/parse-server