CVE-2024-47183

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.

Impact

If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role.

Patches

Improved validation for custom user object IDs. Session tokens for existing users with an object ID that exploits the vulnerability are now rejected.

Workarounds

• Disable custom object IDs by setting allowCustomObjectId: false or not setting the option which defaults to false.
• Use a Cloud Code Trigger to validate that a new user's object ID doesn't start with the prefix role:.

References

• https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg
• https://github.com/parse-community/parse-server/pull/9317 (fix for Parse Server 7)
• https://github.com/parse-community/parse-server/pull/9318 (fix for Parse Server 6)

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.

Impact

If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role.

Patches

Improved validation for custom user object IDs. Session tokens for existing users with an object ID that exploits the vulnerability are now rejected.

Workarounds

• Disable custom object IDs by setting allowCustomObjectId: false or not setting the option which defaults to false.
• Use a Cloud Code Trigger to validate that a new user's object ID doesn't start with the prefix role:.

References

• https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg
• https://github.com/parse-community/parse-server/pull/9317 (fix for Parse Server 7)
• https://github.com/parse-community/parse-server/pull/9318 (fix for Parse Server 6)

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.