Storing Password in Local Storage - parse
Summary
GHSA-wvh7-5p38-2qfc: Storing Password in Local Storage. Affects parse versions < 2.10.0. Fixed in 2.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The parse package is an open-source JavaScript SDK that provides a backend infrastructure for building applications. It allows developers to store data, handle user authentication, and perform other server-side operations. The vulnerability in the parse package involves the insecure storage of user passwords in the browser's local storage.
Vulnerability Detail
The vulnerability arises from the setPassword method in the Parse SDK, which stores the user's password in localStorage as plain text. This makes the password easily accessible to anyone with access to the localStorage. The Parse documentation explicitly states that passwords are never stored in plaintext or transmitted back to the client in plaintext. However, this specific method violates this principle. The vulnerability has a moderate severity rating and is assigned CWE-256. The affected versions of the parse package are 2.9.1 and below.
How To Fix
Minimum fixed version
2.10.0
This is the first release that contains the fix.
npm install parse@2.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually remove the 'password' property from the localStorage after using the setPassword method. Here's an example code snippet:
const user = Parse.User.current();
if (user) {
user.setPassword('newpass');
await user.save();
localStorage.removeItem('password');
}
Conclusion
The parse package has a vulnerability that allows user passwords to be stored insecurely in the browser's local storage. This can potentially lead to unauthorized access to user accounts. Users should upgrade to version 2.10.0 or higher of the parse package to fix this vulnerability. Alternatively, they can manually remove the 'password' property from the localStorage after using the setPassword method. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for parse →
FAQ
The vulnerability exposes user passwords to potential unauthorized access. An attacker with access to the localStorage can retrieve the stored passwords and potentially compromise user accounts.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
Yes, the vulnerability has been fixed in version 2.10.0 of the parse package. Users should upgrade to this version or higher to address the issue.
Yes, as a temporary workaround, you can manually remove the 'password' property from the localStorage after using the setPassword method. Refer to the provided code snippet in the 'workaround' section for an example.
The vulnerability has a moderate severity rating.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
