-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a classic reflected Cross-Site Scripting (XSS) issue within Parse Server's password reset and email verification pages. The root cause is the use of unescaped Mustache template variables ({{{...}}}) instead of the HTML-escaped version ({{...}}).
My analysis of the provided patches, specifically commits f6e61029e8d77e06c7a9438b8a4f0fa6cea9a5db and 51f264b90b2d89d6a8889919238c63f461f9576d, confirms this. The changes in multiple HTML files (e.g., public/password_reset.html, public/email_verification_link_expired.html) consistently replace the triple curly braces with double curly braces for variables that can be controlled by an attacker through URL parameters (token, username, locale, publicServerUrl, appId).
The commits also show that the PublicAPIRouter.js was removed and replaced by PagesRouter.js, which is now responsible for handling these public-facing pages. Although the exact source code of the new PagesRouter.js methods is not in the diff, the functionality remains the same. The vulnerable functions are those that render these templates.
Based on the functionality and the routes tested in the patch (/apps/choose_password), I've identified the methods responsible for handling the GET requests for the password reset and email verification pages as the vulnerable functions. During an exploit, these are the functions that would process the malicious input from the URL and trigger the rendering of the vulnerable templates, causing them to appear in a runtime profile or stack trace.
PagesRouter.changePasswordsrc/Routers/PagesRouter.js
PagesRouter.verifyEmailsrc/Routers/PagesRouter.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| parse-server | npm | < 8.6.1 | 8.6.1 |
| parse-server | npm | >= 9.0.0, < 9.1.0-alpha.3 | 9.1.0-alpha.3 |