Executive Summary

This vulnerability affects Parse Server versions prior to 8.6.61 and 9.6.0-alpha.55. An authenticated user calling the GET /users/me endpoint receives unsanitized authentication data, including sensitive credentials such as MFA TOTP secrets and recovery codes.

The issue arises because the endpoint uses master-level authentication internally for the session query, causing the master context to leak into the user data. This bypasses the usual sanitization performed by the authentication adapter.

As a result, an attacker who obtains a user's session token can extract MFA secrets and generate valid TOTP codes indefinitely.

This vulnerability has been fixed in versions 8.6.61 and 9.6.0-alpha.55 of Parse Server.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows an attacker with a user's session token to access sensitive multi-factor authentication (MFA) secrets, including TOTP secrets and recovery codes.

This means the attacker can generate valid TOTP codes indefinitely, effectively bypassing MFA protections and gaining unauthorized access to the user's account.

Such unauthorized access can lead to account compromise, data theft, and potential further exploitation within the affected infrastructure.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Parse Server to version 8.6.61 or later, or to version 9.6.0-alpha.55 or later, where the issue has been patched.

Additionally, ensure that only authenticated users with proper authorization can access the GET /users/me endpoint, and consider invalidating existing session tokens to prevent attackers from using leaked MFA secrets.

Useful 0 Not Useful 0