Executive brief
Parse SDK for JavaScript inadvertently stores user passwords in the browser's local storage as plaintext when the setPassword() method is called. This violates Parse's own security policy never to store passwords in plaintext, and exposes credentials to anyone with access to the browser's storage (including malicious scripts, extensions, or users with device access). An attacker can steal plaintext passwords to compromise user accounts across applications using this SDK.
Technical details
The vulnerability is a cleartext password storage flaw (CWE-256) in the Parse-SDK-JS setPassword() method. When a user sets a new password via user.setPassword('newpass') followed by user.save(), the SDK stores the plaintext password as a "password" property in the browser's localStorage without sanitization. The attack vector is local—it requires access to the browser's localStorage (reachable by any JavaScript running in the same origin, browser extensions, or device-level access). An attacker can read plaintext credentials directly from storage. The issue was fixed in version 2.10.0 by stripping password properties before persisting User objects to localStorage.
Affected products
- Parse Community Parse SDK for JavaScript < 2.10.0
Timeline
- 2020-07-23: disclosed: Advisory published
- 2020-07-23: patched: Fix released in version 2.10.0