Parse Server Info Disclosure: Bypass Account Lockout via Pre-Auth Checks (GHSA-g6hc-7wv5-7fj9)

Vulnerability Overview Vulnerability Name: User update runs checks against the target account before authorization Severity: Moderate CVSS Score: 6.9 / 10 Description: Before authorizing the caller, the user update operation performs checks against the target account, and the response reflects the results. Callers are not permitted to update users without a session. They can verify whether credentials belong to a specific user, or if , , or are set, verify whether credentials match the user's current or previous passwords, thereby bypassing account lockout protections. Scope of Impact Affected Versions: - - Fixed Versions: - - Remediation Patch: Authorization is now performed before reading the target user account. Callers are not allowed to update users that are denied in the request body, and the target account for these checks can no longer be redirected via object ID. Workaround: There are no known workarounds that fully mitigate this vulnerability. Removing the Parse Server options and can prevent password history leakage. References GitHub Security Advisory: GHSA-g6hc-7wv5-7fj9 Fix Parse Server #18706 Fix Parse Server #18707 Vulnerability Details Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: None - Privileges Required: None - User Interaction: None Impact Metrics: - Confidentiality: Low - Integrity: None - Availability: None Subcomponent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None CVE ID CVE-2024-0000 (Example; the actual ID must be determined based on the specific vulnerability) Vulnerability Status Status: Fixed Coordinator: [Coordinator Name] (Example; the actual name must be determined based on the specific vulnerability) Code Block No specific POC code or exploit code is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

Parse Server Info Disclosure: Bypass Account Lockout via Pre-Auth Checks (GHSA-g6hc-7wv5-7fj9)

More from this source