Executive brief
Parse Server is a backend framework that handles file uploads and API requests for applications. An authenticated attacker could upload a malicious HTML file that gets served under the application's domain, enabling phishing attacks and potential credential theft through the Parse JavaScript SDK.
Technical details
This is an unrestricted file upload vulnerability (CWE-434) in Parse Server's file upload API. An attacker with valid credentials can upload HTML files through the public API without extension validation. The uploaded file becomes accessible at the server's domain, making it appear legitimate for phishing campaigns. When the Parse JavaScript SDK stores session tokens in browser local storage, a malicious HTML page can extract these tokens via JavaScript and exfiltrate them to an attacker-controlled server. The fix restricts file uploads by extension via a new fileUpload.fileExtensions option, disabling HTML uploads by default. Patches are available in versions 5.4.4+ and 6.1.1+.
Affected products
- Parse Community Parse Server <5.4.4 or >=6.0.0 <6.1.1
Timeline
- 2023-05-30: disclosed
- 2023-05-30: patched: Patches released for versions 5.4.4+ and 6.1.1+