CVE-2021-41109
📋 TL;DR
Parse Server versions before 4.10.4 expose user session tokens in LiveQuery payloads when users subscribe to Parse.User class updates. This allows attackers to capture session tokens during user sign-ups, potentially enabling account takeover. All Parse Server deployments using LiveQuery with vulnerable versions are affected.
💻 Affected Systems
- Parse Server
📦 What is this software?
Parse Server by Parseplatform
⚠️ Risk & Real-World Impact
Worst Case
Attackers capture session tokens and gain unauthorized access to user accounts, leading to data theft, privilege escalation, and complete system compromise.
Likely Case
Session tokens are exposed in LiveQuery traffic, allowing attackers with network access to intercept and hijack user sessions.
If Mitigated
With proper network segmentation and access controls, exposure is limited to authorized internal systems only.
🎯 Exploit Status
Exploitation requires network access to LiveQuery traffic and user subscription to Parse.User class.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.10.4
Vendor Advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-7pr3-p5fm-8r9x
Restart Required: Yes
Instructions:
1. Update Parse Server to version 4.10.4 or later using npm: npm update parse-server. 2. Restart the Parse Server application. 3. Verify the update with parse-server --version.
🔧 Temporary Workarounds
Set user ACL on sign-up
allMake new users private immediately on sign-up by setting empty ACL in beforeSave trigger
user.acl(new Parse.ACL())
🧯 If You Can't Patch
- Disable LiveQuery feature entirely if not required
- Implement network segmentation to isolate LiveQuery traffic and restrict access
🔍 How to Verify
Check if Vulnerable:
Check Parse Server version: parse-server --version. If version is below 4.10.4 and LiveQuery is enabled, system is vulnerable.Check Version:
parse-server --versionVerify Fix Applied:
Verify version is 4.10.4 or higher and test that session tokens are not present in LiveQuery payloads for Parse.User subscriptions.📡 Detection & Monitoring
Log Indicators:
- Unexpected session token values in LiveQuery logs
- Multiple user session creations from single IP
Network Indicators:
- Session tokens in LiveQuery WebSocket traffic
- Unauthorized access attempts using captured tokens
SIEM Query:
source="parse-server" AND "LiveQuery" AND "sessionToken"🔗 References
- https://github.com/parse-community/parse-server/commit/4ac4b7f71002ed4fbedbb901db1f6ed1e9ac5559
- https://github.com/parse-community/parse-server/releases/tag/4.10.4
- https://github.com/parse-community/parse-server/security/advisories/GHSA-7pr3-p5fm-8r9x
- https://github.com/parse-community/parse-server/commit/4ac4b7f71002ed4fbedbb901db1f6ed1e9ac5559
- https://github.com/parse-community/parse-server/releases/tag/4.10.4
- https://github.com/parse-community/parse-server/security/advisories/GHSA-7pr3-p5fm-8r9x
