Executive brief
Parse Server is an open-source backend used to build and host applications. A vulnerability exists where users who sign up anonymously are incorrectly flagged as having signed up with a password. If an application uses this flag to grant higher privileges to password-authenticated users, anonymous users could gain unauthorized access to restricted features or data.
Technical details
A vulnerability in Parse Server's REST API causes anonymous user sessions to be incorrectly initialized. Specifically, the 'authProvider' field within the 'createdWith' object of the '_Session' class is set to 'password' instead of 'anonymous' during the initial signup. This is a logic error in session creation that affects developers who manually inspect the 'createdWith' field to implement custom authorization logic or tiered access levels. While Parse Server does not use this field for internal security decisions, third-party application logic relying on it may be bypassed. The issue is fixed in version 4.5.1, though existing sessions remain incorrectly labeled.
Affected products
- parse-community parse-server < 4.5.1
Timeline
- 2021-08-18: patched: Fix committed to repository
- 2021-08-19: disclosed: NVD publication date
- 2021-08-23: advisory: GitHub Security Advisory published