Parse Server User Update Information Disclosure

Executive Summary

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 has a flaw where user update operations check account details before verifying the caller's authorization. This allows unauthorized users to confirm guessed usernames or emails and, if certain password policies are enabled, guess current or previous passwords by observing error responses. The issue bypasses account lockout protections.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Parse Server version is between 8.0.0-8.6.98 or 9.0.0-9.10.3-alpha.1. Use commands like 'npm list parse-server' or check your package.json to verify the installed version. If affected, test by attempting unauthorized user update operations and observing if error responses reveal sensitive information.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to confirm valid usernames or emails in your system, increasing phishing risks. If password policies like maxPasswordHistory or doNotAllowUsername are enabled, they might also guess passwords by checking responses, potentially leading to unauthorized account access without triggering lockouts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR's data protection principles by exposing personal data (usernames/emails) and HIPAA's safeguards for protected health information if user accounts are compromised. It undermines security controls required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Parse Server to version 9.10.3-alpha.2 or later, or 8.6.99 or later. If upgrading is not possible, disable affected password policies like maxPasswordHistory or doNotAllowUsername as a temporary mitigation. Ensure authorization checks are enforced before any account checks during user updates.

Useful 0 Not Useful 0