GHSA-43rg-r2xr-q686: 
JavaScript vulnerability analysis and mitigation

Impact

When a request to create a user carries auth data that belongs to an existing user, Parse Server logs that user in. The response contained the user object as stored, without applying the user's read access. It could therefore contain fields that class-level permissions, the object's ACL or protected fields hide from the user, and auth data that an auth adapter hides in other responses, such as the secret and recovery codes of the multi-factor authentication adapter. The same response was returned for such a request with a session token of that user, so someone who holds a session token of a user with multi-factor authentication and a linked auth provider could obtain the user's MFA secret and recovery codes without an MFA token. Only the object of the user who logs in is returned. Requests with the master key or maintenance key are not affected.

Patches

The response now contains the user as the user itself can read it, the same as the response of the login endpoint: class-level permissions, the ACL, protected fields, find triggers of the user class and the auth adapters apply. If the user cannot read its own object, the response contains only the object ID and the session token. As a consequence, the response no longer contains data that an auth adapter hides, for example the provider's access token for adapters that use an authorization code. Parse Server 8 is not patched.

Workarounds

There is no known workaround.

References

• GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-43rg-r2xr-q686
• Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10886