https://feed.craftedsignal.io/vendors/parse/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 30 Jan 2024 12:00:00 +0000https://feed.craftedsignal.io/briefs/2024-01-30-parse-server-auth-leak/Tue, 30 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-30-parse-server-auth-leak/Parse Server versions before 8.6.61 and versions 9.0.0 to 9.6.0-alpha.55 expose sensitive MFA credentials via the `/users/me` endpoint, allowing authenticated users to extract TOTP secrets and recovery codes.Parse Server, an open-source backend framework, contains a vulnerability in versions before 8.6.61 and versions 9.0.0 up to 9.6.0-alpha.55. The /users/me endpoint inadvertently exposes sensitive authentication data, including MFA TOTP secrets and recovery codes. An authenticated user possessing a valid session token can exploit this flaw. The root cause lies in the endpoint's use of master-level authentication for the session query, causing the master context to leak into user data and bypass security sanitization. This vulnerability, disclosed on March 24, 2026, as GHSA-37mj-c2wf-cx96, can lead to unauthorized access and account compromise. Defenders should prioritize patching vulnerable Parse Server instances to prevent potential credential compromise.

Attack Chain

1. An attacker identifies a Parse Server instance running a vulnerable version (below 8.6.61 or between 9.0.0 and 9.6.0-alpha.55).
2. The attacker obtains valid user credentials through standard means (e.g., registration, password reset, or credential stuffing).
3. The attacker successfully authenticates to the Parse Server and receives a valid session token.
4. The attacker crafts a GET request to the /users/me endpoint, including the valid session token in the request headers.
5. The Parse Server processes the request, using master-level authentication for the initial session query.
6. Due to the bypassed sanitization, the response includes the targeted user's sensitive MFA TOTP secret and recovery codes.
7. The attacker uses the extracted TOTP secret to generate valid, time-based MFA codes.
8. The attacker uses the generated MFA codes, or the recovery codes, to bypass MFA and gain full access to the user's account.

Impact

Successful exploitation of this vulnerability allows attackers to bypass multi-factor authentication controls and gain unauthorized access to user accounts. The number of affected Parse Server instances is unknown. Impacted organizations could experience account takeovers, data breaches, and reputational damage. The severity is high due to the ease of exploitation (requires only a valid session token) and the direct exposure of MFA secrets.

Recommendation

• Upgrade Parse Server instances to a patched version (8.6.61 or later, or 9.6.0-alpha.55 or later) to remediate CVE-2026-33627.
• Deploy the Sigma rule "Detect Access to Users Me Endpoint" to monitor access patterns to the vulnerable endpoint.
• Enable detailed logging for web server requests to capture requests to the /users/me endpoint to facilitate investigations.

]]>highadvisoryparse-servercredential-accessmfa-bypasshttps://feed.craftedsignal.io/briefs/2024-01-02-parse-server-sqli/Tue, 02 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-02-parse-server-sqli/A SQL injection vulnerability in Parse Server's PostgreSQL adapter allows an attacker with master key access to execute arbitrary SQL statements via crafted field names in aggregate `$group` or `distinct` operations, leading to privilege escalation.A SQL injection vulnerability has been identified in the PostgreSQL adapter of Parse Server versions prior to 8.6.59 and between 9.0.0 and 9.6.0-alpha.53. This flaw enables an attacker who has already gained master key access to the Parse Server instance to inject arbitrary SQL commands. The vulnerability stems from insufficient validation of field names used within the aggregate $group pipeline stage or the distinct operation. By injecting SQL metacharacters into these field names, an attacker can bypass intended restrictions and execute unauthorized database operations. This vulnerability specifically affects Parse Server deployments using PostgreSQL and does not impact those utilizing MongoDB. Successful exploitation leads to privilege escalation, granting the attacker PostgreSQL database-level access, potentially compromising sensitive data and system integrity.

Attack Chain

1. Attacker gains master key access to the Parse Server application, potentially through credential compromise or vulnerability exploitation in another part of the application.
2. The attacker crafts a malicious API request targeting either the aggregate $group pipeline stage or the distinct operation.
3. The crafted API request includes SQL metacharacters embedded within the field name parameters of the $group._id object or the distinct dot-notation parameters.
4. Parse Server receives the request and, due to insufficient validation, passes the tainted field names to the PostgreSQL storage adapter.
5. The PostgreSQL storage adapter uses the tainted field names in a :raw interpolation when constructing the SQL query.
6. The injected SQL metacharacters are interpreted by the PostgreSQL database, altering the intended query logic.
7. The attacker executes arbitrary SQL commands, such as creating new users with elevated privileges or dumping sensitive data.
8. The attacker successfully escalates privileges from Parse Server application-level administrator to PostgreSQL database-level access, allowing for full control of the database.

Impact

Successful exploitation of this SQL injection vulnerability allows an attacker to escalate privileges from a Parse Server administrator to a PostgreSQL database administrator. This could lead to the complete compromise of the database, including unauthorized access to sensitive data, modification of existing data, and denial of service. The vulnerability affects Parse Server deployments using PostgreSQL, potentially impacting any organization using vulnerable versions. Given the nature of Parse Server as a backend for mobile and web applications, a successful attack could expose user data and application logic, leading to significant financial and reputational damage.

Recommendation

• Upgrade Parse Server to version 8.6.59 or greater, or version 9.6.0-alpha.53 or greater, to patch CVE-2026-33539.
• Implement input validation on the server side to sanitize field names before they are passed to the PostgreSQL adapter. While a full fix should be deployed, this provides defense in depth.
• Monitor PostgreSQL logs for suspicious queries that contain unexpected SQL metacharacters in field names. Adapt the provided Sigma rule Detect Suspicious Parse Server PostgreSQL Queries to your logging environment.

]]>highadvisorysql-injectionprivilege-escalationparse-server