Parse Server Instagram Authentication Adapter Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in the Instagram authentication adapter of Parse Server. This issue affects versions 9.0.0 prior to 9.1.1-alpha.1 and versions prior to 8.6.2. The vulnerability allows clients to specify a custom API URL, which could be exploited to perform SSRF attacks. Additionally, there is a possibility of authentication bypass if malicious endpoints return deceptive responses that validate unauthorized users.

Impact

Exploitation of this vulnerability could lead to SSRF attacks, allowing an attacker to make server-side requests to internal services or resources. Furthermore, there is a potential for authentication bypass, enabling unauthorized users to gain access by manipulating the authentication process.

Remediation

Users can upgrade to Parse Server versions 9.1.1-alpha.1 or 8.6.2 to address this vulnerability. Instructions for upgrading can be found in the Parse Server documentation.