Horizon Alert
Summary of the vulnerability and why it matters
Parse Server, when using its built-in LDAP authentication, has a critical vulnerability that can allow unauthorized access to accounts. This issue arises because the system may not properly verify credentials, potentially enabling attackers to gain session tokens for known user accounts. The primary concern is confirming if your environment utilizes this specific LDAP adapter configuration, as only those deployments are susceptible.
- Bypass of account login controls.
- Critical for confirming if your configuration is at risk.
- Assess relevance to understand potential exposure.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this vulnerability by targeting Parse Server deployments that use the LDAP authentication adapter. If the adapter is configured to forward client-supplied passwords to the directory without proper validation, an attacker can send a request with an empty password for a known user. Certain directory configurations, like a default Active Directory setup, will treat this as a valid, anonymous bind, allowing the attacker to receive a session token for that user and take over the account.
- Entry condition: LDAP adapter enabled; user's username known.
- Trigger point: Empty password sent during LDAP simple bind.
- Resulting risk: Unauthenticated account takeover.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an unauthenticated attacker to gain access to user accounts by exploiting a flaw in the LDAP authentication adapter. When an attacker knows a valid directory username, they can bypass authentication by supplying an empty password. This allows the attacker to obtain a valid session token, potentially leading to account takeover, but only when the LDAP adapter is enabled and configured in a specific way where the directory responds to unauthenticated simple binds.
- User account credentials and session tokens.
- Empty password bypass to LDAP server.
- Unauthorized account access and takeover.
Operational Fix
Recommended remediation, mitigation, and detection steps
Attackers can bypass authentication in Parse Server's LDAP adapter by sending an empty password, leading to account takeover. This affects deployments that enable the LDAP adapter and are configured to accept unauthenticated simple binds. The first step is to identify all Parse Server instances, determine if the LDAP adapter is enabled and exposed, and confirm the accountable owner for remediation.
- Assign ownership to application or platform teams.
- Verify LDAP adapter configuration and reachability.
- Plan coordinated remediation or vendor engagement.
