Executive brief
Parse Server is a backend-as-a-service framework used to build web and mobile applications. The Facebook and Spotify authentication adapters fail to properly validate app IDs when the configuration is set as a string instead of an array, allowing attackers with a different app ID (that is a substring of the legitimate one) to authenticate successfully. This could lead to unauthorized access to applications using this misconfiguration.
Technical details
The vulnerability is a validation bypass (CWE-287) in Parse Server's Facebook and Spotify authentication adapters. The root cause is inadequate type checking on the appIds configuration parameter: the code accepts both string and array values, but only properly validates app IDs when an array is provided. When appIds is set as a string (e.g., "abc"), an attacker with a different app ID that is a substring of the configured value (e.g., "ab") can pass validation. The attack is network-based and requires no authentication or user interaction, but has a high attack complexity since the attacker must first obtain an app ID assignment from the authentication provider that matches as a substring. Both Facebook and Spotify still validate access tokens with their respective providers, limiting the impact to integrity. Patches are available in versions 4.10.16 and 5.2.7.
Affected products
- Parse Community Parse Server <4.10.16 or >=5.0.0 <5.2.7
Timeline
- 2022-09-20: disclosed
- 2022-09-21: patched