GHSA-2j2x-c587-q33g: Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession
Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the Session class create class-level permission. Attackers holding a user's session token can send an already revocable token to /upgradeToRevocableSession to obtain additional sessions with fresh expiration that persist after the original session is logged out.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 8.6.112 - Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 9.10.6-alpha.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid session token for a user. The issue is specifically exploitable when that token is already revocable and can be submitted to the /upgradeToRevocableSession endpoint.
What is the practical impact after exploitation?
The attacker can obtain additional sessions with fresh expiration for the affected user. Those sessions remain valid after the original session is logged out, allowing continued access associated with that user session.
Does restricting _Session creation prevent exploitation?
No. The vulnerable endpoint creates the new session without enforcing the _Session class-level create permission, so that permission does not stop the described bypass in affected versions.
Which releases are affected?
Parse Server versions before 8.6.112 are affected, as are 9.0.0 through versions before 9.10.6-alpha.4.