| Package | Affected versions | Patched versions |
|---|---|---|
| parse-server | = 9.7.0≥ 9.0.0, < 9.7.0< 8.6.69 | 9.7.08.6.69 |
| parse-server | ≥ 9.0.0, < 9.7.0-alpha.14< 8.6.69 | 9.7.0-alpha.148.6.69 |
An authenticated user can bypass the immutability guard on session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies.
The truthiness-based guard checks were replaced with key-presence checks that reject any value for protected session fields, including null.
There is no known workaround. A beforeSave trigger on _Session could be used to reject null values for expiresAt and createdWith.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free