parse-server: Custom auth adapters that extend the AuthAdapter class accept any authData

Impact

A custom authentication adapter that extends Parse Server's exported AuthAdapter class and implements the validateSetUp, validateLogin and validateUpdate methods, as the class documentation describes, never had those methods called. Parse Server instead used a default inherited from the base class, which accepts any authentication data. For a provider served by such an adapter, an attacker can sign up, link an identity, or log in as an existing user without valid credentials for that provider, and can skip a custom adapter that implements an additional authentication factor. Only apps that configure a custom authentication adapter built as a subclass of AuthAdapter are affected; built-in adapters and custom adapters defined as plain objects are not affected.

Patches

Methods that an adapter inherits unchanged from the AuthAdapter base class are no longer treated as implemented, so a subclass's own validation methods run, and the adapter's own beforeFind method is now also called. The methods of a custom adapter that is a class instance now run on a per-request copy of the configured instance, so they can use its state and helper methods. A subclass that implements only some of validateSetUp, validateLogin and validateUpdate is now rejected as not configured instead of accepting any authentication data. In Parse Server 8, unlinking an authentication provider also no longer calls the adapter's beforeFind method, as in Parse Server 9.

Workarounds

Implement all validation in an overridden validateAuthData method of the subclass that does not rely on the adapter instance's own state, or define the custom adapter as a plain object with the validation methods instead of a subclass of AuthAdapter.

References

• GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-rq3w-5c6f-p7wr
• Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10773
• Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10774