You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I have recently noticed that a new parse-server project (i.e. one that hasn't been migrated from hosted Parse) has a security issue with the _User class.
Essentially parse-server creates the _User in the _SCHEMA collection, but it doesn't default to locked down _metadata permissions — thus exposing the entire user base with a simple new Parse.Query("_User").find() query.
I propose that when the _User class is created, we lock it down automatically. If I have time I'll try and add a fix for this, but I thought I would highlight it asap to prevent any undue security issues with new apps using parse-server.
The text was updated successfully, but these errors were encountered:
jamiechapman
changed the title
Default _metadata class permissions for _User
Security issue with default _User class permissions (new apps only)
Feb 12, 2016
Thanks for the note! Fortunately this only affects new apps, so any migrated apps won't be vulnerable to new security issues. A PR would be very much appreciated :)
I have recently noticed that a new parse-server project (i.e. one that hasn't been migrated from hosted Parse) has a security issue with the
_User
class.Essentially parse-server creates the
_User
in the_SCHEMA
collection, but it doesn't default to locked down_metadata
permissions — thus exposing the entire user base with a simplenew Parse.Query("_User").find()
query.I propose that when the
_User
class is created, we lock it down automatically. If I have time I'll try and add a fix for this, but I thought I would highlight it asap to prevent any undue security issues with new apps using parse-server.The text was updated successfully, but these errors were encountered: