GHSA-3f5f-xgrj-97pf
Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | parse-server | >= 9.0.0, < 9.1.1-alpha.1 | 9.1.1-alpha.1 |
| npm | parse-server | < 8.6.2 | 8.6.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
## Impact
The Instagram authentication adapter allows clients to specify a custom API URL via the `apiURL` parameter in `authData`. This enables SSRF attacks and possibly authentication bypass if malicious endpoints return fake responses to validate unauthorized users.
## Patches
Fixed by hardcoding the Instagram Graph API URL `https://graph.instagram.com` and ignoring client-provided `apiURL` values.
## Workarounds
None.
References
External links from the advisory. They lead to third-party sites.