CyberRota Analysis
AI-GeneratedVersions of Parse Server up to 8.6.87 and between 9.0.0 and 9.10.1-alpha.7 are vulnerable due to an authentication bypass in the LDAP authentication adapter, allowing unauthenticated attackers to obtain valid session tokens by exploiting zero-length credentials. This flaw primarily impacts deployments that enable the LDAP authentication adapter and use directories that accept unauthenticated binds, such as default configurations of Active Directory. Organizations utilizing these versions with LDAP authentication should prioritize immediate updates to versions 8.6.88 or 9.10.1-alpha.7 to mitigate the risk of account takeover.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory as proof of authentication. A zero-length credential turns an LDAP simple bind into the unauthenticated authentication mechanism described in RFC 4513 section 5.1.2, which some directories (including Active Directory in its default configuration) answer with success while mapping the connection to anonymous. As a result, an unauthenticated attacker who knows a directory username can obtain a valid session token for that account, resulting in account takeover. Only deployments that enable the LDAP authentication adapter are affected, and deployments whose directory refuses unauthenticated simple bind (such as a stock OpenLDAP configuration) are not exploitable. The issue is fixed in 8.6.88 and 9.10.1-alpha.7, which require the password to be a non-empty string and reject the request before contacting the directory.