Parse SDK JavaScript password exposure in localStorage

Severity: info · Published 2020-07-23

Parse SDK for JavaScript inadvertently stores user passwords in the browser's local storage as plaintext when the setPassword() method is called. This violates Parse's own security policy never to store passwords in plaintext, and exposes credentials to anyone with access to the browser's storage (including malicious scripts, extensions, or users with device access). An attacker can steal plaintext passwords to compromise user accounts across applications using this SDK.

Technologies: parse (npm). Vendors: npm, Parse Community.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Informational severity, published 23 July 2020.
Which products and versions are affected?
parse (npm) SEMVER:introduced=0,fixed=2.10.0; Parse Community Parse SDK for JavaScript < 2.10.0.
Is there a fix for This vulnerability?
Yes. parse (npm): upgrade to 2.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked with local access, in a software library.
Am I affected?
Check whether you run parse (npm) or Parse Community Parse SDK for JavaScript at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • parse (npm): upgrade to 2.10.0 or later
    npm install parse@2.10.0

Technical details

The vulnerability is a cleartext password storage flaw (CWE-256) in the Parse-SDK-JS setPassword() method. When a user sets a new password via user.setPassword('newpass') followed by user.save(), the SDK stores the plaintext password as a "password" property in the browser's localStorage without sanitization. The attack vector is local—it requires access to the browser's localStorage (reachable by any JavaScript running in the same origin, browser extensions, or device-level access). An attacker can read plaintext credentials directly from storage. The issue was fixed in version 2.10.0 by stripping password properties before persisting User objects to localStorage.

Affected products

  • Parse Community Parse SDK for JavaScript < 2.10.0

Timeline

  • 2020-07-23: disclosed: Advisory published
  • 2020-07-23: patched: Fix released in version 2.10.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.