metacloud@0.2.0

Vulnerabilities

1 via 1 paths

Dependencies

9

Source

npm

Find, fix and prevent vulnerabilities in your code.

Severity
  • 1
Status
  • 1
  • 0
  • 0

medium severity

Insufficiently Protected Credentials

  • Vulnerable module: parse
  • Introduced through: parse@1.11.1

Detailed paths

  • Introduced through: metacloud@0.2.0 parse@1.11.1
    Remediation: Upgrade to parse@2.10.0.

Overview

parse is a library that gives you access to the powerful Parse Server backend from your JavaScript app.

Affected versions of this package are vulnerable to Insufficiently Protected Credentials. The setPassword method (http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.html#setPassword) stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time that password is stored at all. In the documentation under Users > Signing Up, it clearly states, "We never store passwords in plaintext, nor will we ever transmit passwords back to the client in plaintext."

PoC by Diamond Lewis and Colin Ulin

async () => {
    const user = Parse.User.current()
    if (user) {
        user.setPassword('newpass')
        await user.save()
    }
}

After running the above code, the new password will be stored in localStorage as a property named "password".

Remediation

Upgrade parse to version 2.10.0 or higher.

References