Parse Server up to 4.10.15/5.2.6 Authentication Provider improper authentication

Summaryinfo

A vulnerability identified as critical has been detected in Parse Server up to 4.10.15/5.2.6. Impacted is an unknown function of the component Authentication Provider. Performing a manipulation results in improper authentication. This vulnerability is cataloged as CVE-2022-39231. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Parse Server up to 4.10.15/5.2.6. This affects some unknown functionality of the component Authentication Provider. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.16, or from 5.0.0 to 5.2.6, validation of the authentication adapter app ID for _Facebook_ and _Spotify_ may be circumvented. Configurations which allow users to authenticate using the Parse Server authentication adapter where `appIds` is set as a string instead of an array of strings authenticate requests from an app with a different app ID than the one specified in the `appIds` configuration. For this vulnerability to be exploited, an attacker needs to be assigned an app ID by the authentication provider which is a sub-set of the server-side configured app ID. This issue is patched in versions 4.10.16 and 5.2.7. There are no known workarounds.

The weakness was shared 09/23/2022 as GHSA-r657-33vp-gp22. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2022-39231 since 09/02/2022. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 4.10.16 or 5.2.7 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Parse Server

Version

• 4.10.0
• 4.10.1
• 4.10.2
• 4.10.3
• 4.10.4
• 4.10.5
• 4.10.6
• 4.10.7
• 4.10.8
• 4.10.9
• 4.10.10
• 4.10.11
• 4.10.12
• 4.10.13
• 4.10.14
• 4.10.15
• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 5.2.4
• 5.2.5
• 5.2.6

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion