A vulnerability was found in parser-server up to 4.0.x and classified as problematic. Affected by this issue is an unknown functionality of the component Regex Handler. The manipulation as part of a SQL Query leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality. CVE summarizes:

In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken and find valid accounts this way.

The weakness was disclosed 03/04/2020 (GitHub Repository). The advisory is shared for download at github.com. This vulnerability is handled as CVE-2020-5251 since 01/02/2020. The exploitation is known to be difficult. The attack may be launched remotely. The successful exploitation needs a simple authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 4.1.0 eliminates this vulnerability.

Productinfo

Name

• parser-server

Version

• 4.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion