Executive brief
Parse Server is a backend framework that manages user sessions and data. An authenticated attacker can modify another user's session object if they know its ID, potentially reassigning it to their own account to access custom session fields. While this does not directly expose session tokens or enable account takeover, it can leak sensitive session metadata and may enable privilege escalation in deployments that use session objects for access control.
Technical details
The vulnerability is an insecure direct object reference (IDOR) in the session object write handler. Parse Server fails to validate that the authenticated user owns the session object being modified, allowing any authenticated user to write to foreign session objects if the object ID is known. The attack requires network access and an authenticated account (low privilege). An attacker can modify the user field of a victim's session object to reassign it to themselves, then read custom fields; however, the session token itself cannot be extracted for token-based impersonation. The fix in versions 4.10.15 and 5.2.6+ enforces ownership checks before allowing session modifications.
Affected products
- Parse Community parse-server <4.10.15 or >=5.0.0 <5.2.6
Timeline
- 2022-09-21: disclosed: Advisory published
- 2022-09-21: patched: Fix released in versions 4.10.15 and 5.2.6