Executive brief
Parse Server is a backend framework used to build scalable database-driven applications. LiveQuery is a real-time data synchronization feature that broadcasts database changes to subscribed clients. A vulnerability causes user session tokens—sensitive credentials used for API authentication—to be included in LiveQuery broadcasts when users sign up, exposing these tokens to any subscriber listening to user data.
Technical details
The vulnerability is an information disclosure (CWE-200) in Parse Server's LiveQuery implementation. During regular (non-LiveQuery) queries, session tokens are filtered from responses, but this filtering is not applied to LiveQuery payloads. If an attacker subscribes to LiveQuery updates on the Parse.User class, all session tokens generated during user sign-ups will be broadcast as part of the payload. This requires network access to the Parse Server and a LiveQuery subscription, but no authentication or user interaction is needed to subscribe and intercept tokens. An attacker can use captured session tokens to impersonate users and perform unauthorized API operations. The fix was released in parse-server version 4.10.4, which removes session tokens from LiveQuery payloads.
Affected products
- Parse Community parse-server < 4.10.4
Timeline
- 2021-09-30: disclosed
- 2021-09-30: patched: Fixed in parse-server 4.10.4