CVE-2023-32689: Parse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML file
First published: Tue May 30 2023(Updated: )
### Impact Phishing attack vulnerability by uploading malicious files. A malicious user could upload a HTML file to Parse Server via its public API. That HTML file would then be accessible at the internet domain at which Parse Server is hosted. The URL of the the uploaded HTML could be shared for phishing attacks. The HTML page may seem legitimate because it is served under the internet domain where Parse Server is hosted, which may be the same as a company's official website domain. An additional security issue arises when the Parse JavaScript SDK is used. The SDK stores sessions in the internet browser's local storage, which usually restricts data access depending on the internet domain. A malicious HTML file could contain a script that retrieves the user's session token from local storage and then share it with the attacker. ### Patches The fix adds a new Parse Server option `fileUpload.fileExtensions` to restrict file upload on Parse Server by file extension. It is recommended to restrict file upload for HTML file extensions, which this fix disables by default. If an app requires upload of files with HTML file extensions, the option can be set to `['.*']` or another custom value to override the default. ### References - https://github.com/parse-community/parse-server/security/advisories/GHSA-9prm-jqwx-45x9 - https://github.com/parse-community/parse-server/pull/8538 (Parse Server 6) - https://github.com/parse-community/parse-server/pull/8537 (Parse Server 5)
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Parseplatform Parse-server | <5.4.4 | |
| Parseplatform Parse-server | >=6.0.0<6.1.1 | |
| npm/parse-server | >=6.0.0<6.1.1 | 6.1.1 |
| npm/parse-server | <5.4.4 | 5.4.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/parse-community/parse-server/security/advisories/GHSA-9prm-jqwx-45x9
- https://github.com/parse-community/parse-server/pull/8537
- https://github.com/parse-community/parse-server/pull/8538
- https://nvd.nist.gov/vuln/detail/CVE-2023-32689
- https://github.com/advisories/GHSA-9prm-jqwx-45x9 (Advisory)
Frequently Asked Questions
What is CVE-2023-32689?
CVE-2023-32689 is a vulnerability in Parse Server, an open source backend that allows uploading malicious files via its public API.
What is the impact of CVE-2023-32689?
The vulnerability in CVE-2023-32689 allows for a phishing attack by uploading a malicious HTML file to Parse Server, which can be accessed via the internet domain where Parse Server is hosted.
How can a malicious user exploit CVE-2023-32689?
A malicious user can exploit CVE-2023-32689 by uploading a malicious HTML file to Parse Server using its public API.
Which versions of Parse Server are affected by CVE-2023-32689?
Versions up to and including 6.1.1 of Parse Server are affected by CVE-2023-32689.
How can I fix CVE-2023-32689?
To fix CVE-2023-32689, upgrade Parse Server to version 6.1.1 or apply the provided fix in the security advisories.
- collector/nvd-latest
- collector/nvd-index
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-9prm-jqwx-45x9
- alias/CVE-2023-32689
- collector/github-advisory
- agent/author
- agent/type
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- vendor/parseplatform
- canonical/parseplatform parse-server
- version/parseplatform parse-server/6.0.0
- package-manager/npm