Executive brief
Parse Server is a popular backend framework that handles user authentication and authorization. When custom object IDs are enabled, an authenticated attacker with user creation privileges can set a specially crafted object ID to impersonate a role and gain administrative or elevated privileges. This could allow unauthorized access to sensitive data and administrative functions.
Technical details
Parse Server allows administrators to enable custom object ID assignment via the allowCustomObjectId option. The vulnerability exists in insufficient validation of user object IDs when this feature is enabled. An attacker with user creation privileges can craft an object ID prefixed with "role:" to exploit role-based access control mechanisms and acquire privileges of an arbitrary role. The attack requires network access and valid user creation permissions, but no special user interaction. The vulnerability affects Parse Server versions before 6.5.9 and 7.0.0 through 7.3.0, with patches available in 6.5.9+ and 7.3.0+.
Affected products
- Parse Community Parse Server <6.5.9 and >=7.0.0 <7.3.0
Timeline
- 2024-10-04: disclosed: Vulnerability published on GitHub Security Advisories
- 2024-10-04: patched: Patches released in versions 6.5.9 and 7.3.0