Information disclosure in parse-server

Description

1. you can fetch all the users’ objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken ("_SessionToken":{"$regex":"r:027f"}} and find valid accounts this way.

Using this method, it’s possible to retrieve accounts without interaction from the users.

GET /parse/users/me HTTP/1.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): <= 4.0.0
• Patched version(s): 4.1.0

References

• GHSA-h4mf-75hf-67w4
• CVE-2020-5251
• CWE-200
• CWE-285
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Parse Server stores password in plain text - CVE-2020-26288
• Parse Server allows public `explain` queries which may expose sensitive database performance information and schema deta - CVE-2025-64502
• parse-server auth adapter app ID validation can be circumvented - CVE-2022-39231
• Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012

Tags:

npm

parse-server