CVE-2021-41109: Open Source Vulnerability in Parse Server
Summary
CVE-2021-41109: LiveQuery publishes user session tokens. Affects parse versions < 4.10.4. Fixed in 4.10.4. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2021-41109 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open source backend that can be deployed to any infrastructure running Node.js. It provides functionality for handling user sign-ups and queries. The vulnerability in Parse Server, prior to version 4.10.4, allows session tokens created during user sign-ups to be broadcast as part of LiveQuery payloads. This poses a security risk as sensitive session tokens can be exposed to unauthorized users.
Vulnerability Detail
The vulnerability arises from the fact that, for regular queries, the session token is removed from the response, but for LiveQuery payloads, it is not. If a user has a LiveQuery subscription on the Parse.User class, all session tokens created during user sign-ups will be included in the LiveQuery payload. This can lead to session token exposure and potential unauthorized access to user accounts. The vulnerability has a high severity rating (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
How To Fix
Minimum fixed version
4.10.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can set user.acl(new Parse.ACL()) in a beforeSave trigger to make the user private during sign-up. This will prevent the session token from being included in the LiveQuery payload. However, it is still advisable to update to the latest version of Parse Server to fully address the vulnerability.
Conclusion
The vulnerability in Parse Server allows session tokens to be exposed in LiveQuery payloads, potentially leading to unauthorized access to user accounts. It is crucial to update Parse Server to version 4.10.4 or later to fix this vulnerability. In the meantime, setting user.acl(new Parse.ACL()) in a beforeSave trigger can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for parse →
FAQ
Parse Server is an open source backend that can be deployed to any infrastructure running Node.js. It provides functionality for handling user sign-ups and queries.
LiveQuery is a feature in Parse Server that allows real-time subscriptions to changes in the database. It enables clients to receive updates whenever data matching a query is created, updated, or deleted.
The vulnerability in Parse Server allows session tokens created during user sign-ups to be included in LiveQuery payloads. This can lead to session token exposure and potential unauthorized access to user accounts.
The vulnerability has a high severity rating (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). It is important to address this vulnerability promptly to prevent potential security breaches.
To fix this vulnerability, it is recommended to update Parse Server to version 4.10.4 or later. This version includes a patch that removes session tokens from LiveQuery payloads, mitigating the risk of session token exposure.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
