Listen to this Post
The vulnerability exists within the HTML pages served for password reset and email verification functionalities in Parse Server. These pages utilize Mustache templating to dynamically insert user-provided values, such as email addresses or usernames, into the final HTML document. Prior to the patch, these user-controlled variables were not properly escaped or sanitized before being rendered. An attacker can craft a malicious link containing a script payload within one of these parameters. When an unsuspecting user clicks the link, the server reflects the unescaped payload into the webpage’s HTML. The user’s browser then receives and executes the embedded JavaScript in the context of the Parse Server domain, allowing the attacker to steal session tokens, perform actions on behalf of the user, or deface the page.
Platform: Parse Server
Version: < 8.6.1, 9.0.0-9.1.0-alpha.3
Vulnerability: Reflected XSS
Severity: Moderate
date: 2025-12-16
Prediction: Patched 2025-12-16
What Undercode Say:
Analytics:
bash
curl -s “https://api.github.com/advisories?affected=parse-server” | jq ‘.[] | select(.severity==”MODERATE”) | .summary’
grep -r “mustache.escape” node_modules/parse-server/
How Exploit:
Malicious Password Reset Link
http://target-server.parse-app.com/parse/apps/reset_password?token=valid&email=
Server-Side Vulnerable Code (Example)
html
An email was sent to {{email}}.
Protection from this CVE:
Update to 8.6.1
Update to 9.1.0-alpha.3
Escape template variables
Impact:
Session Hijacking
User Impersonation
Data Theft
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
