GHSA-8xq9-g7ch-35hg

Source

https://github.com/advisories/GHSA-8xq9-g7ch-35hg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-8xq9-g7ch-35hg/GHSA-8xq9-g7ch-35hg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8xq9-g7ch-35hg

Aliases

Published

2024-10-04T18:50:56Z

Modified

2024-10-08T08:12:09Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Parse Server's custom object ID allows to acquire role privileges

Details

Impact

If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role.

Patches

Improved validation for custom user object IDs. Session tokens for existing users with an object ID that exploits the vulnerability are now rejected.

Workarounds

Disable custom object IDs by setting allowCustomObjectId: false or not setting the option which defaults to false.
Use a Cloud Code Trigger to validate that a new user's object ID doesn't start with the prefix role:.

References

https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg
https://github.com/parse-community/parse-server/pull/9317 (fix for Parse Server 7)
https://github.com/parse-community/parse-server/pull/9318 (fix for Parse Server 6)

Database specific

{
    "cwe_ids":  [
        "CWE-285",
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-10-04T18:50:56Z",
    "nvd_published_at":  "2024-10-04T15:15:13Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / parse-server

Package

Name: parse-server; View open source insights on deps.dev
Purl: pkg:npm/parse-server

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.5.9

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-8xq9-g7ch-35hg/GHSA-8xq9-g7ch-35hg.json"

npm / parse-server

Package

Name: parse-server; View open source insights on deps.dev
Purl: pkg:npm/parse-server

Affected ranges

Type: SEMVER
Events: Introduced

7.0.0

Fixed

7.3.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-8xq9-g7ch-35hg/GHSA-8xq9-g7ch-35hg.json"