parse-server: Session creation endpoint bypasses create and addField class-level permissions

Impact

An authenticated user can create a session for their own account even when the class-level permissions of the _Session class do not permit the user to create sessions, and can add new fields to the _Session class even when the class-level permissions do not permit adding fields. Depending on the Parse Server version, the token of the created session is returned in the response, or the request is rejected after the session has already been created. This allows a user, or anyone in possession of a user's session token, to create additional sessions for that user contrary to the class-level permissions of the deployment; such sessions are not revoked when the original session is logged out. Only deployments that restrict the create or add field class-level permission of the _Session class are affected.

Patches

Session creation now enforces the create and add field class-level permissions of the _Session class, and validates the request with the permissions of the requesting user, before the session is created.

Workarounds

Neither class-level permissions nor Cloud Code triggers can prevent this, as the _Session class only supports the afterLogout trigger. If clients do not need to create sessions, block client requests that create _Session objects before they reach Parse Server, which are REST API POST requests to /sessions and /classes/_Session, including as part of batch requests, and disable the GraphQL API create mutation of the _Session class with the GraphQL class configuration mutation: { create: false }.

References

• GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-gj37-5hg5-p729
• Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10744
• Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10745