Security Issue

[arjun3396]

I have sent a mail to security@parseplatform.org on 13/02/21 about a security issue from [removed] this email id, the subject line of mail is "security issue", it said we will get a reply within 7 days but still, there is no reply from parse end so created an issue here, can someone who has access to the emails please check that email and revert? similarly, I have also created a vulnerability on https://form.jotform.com/parseplatform/report-a-vulnerability you can check there also.

Edit: removed email address

[mtrezza]

Thanks for reminding and posting discreet about the issue, we'll look into this.

@TomWFox @davimacedo would you please take a look?

@arjun3396 I found your reported issue via webform, I'm looking into its current state and will update here.

[mtrezza]

@arjun3396 I have invited you to the security advisory to discuss your report.

[davimacedo]

For the sake of the reporting process, where are those reports going to? I don't remember to have received any e-mail neither in parse admin nor in my personal mailbox. Did you guys receive? @mtrezza @TomWFox @dplewis

[mtrezza]

@davimacedo I don't have access to the email, so I looked into the webform admin panel where I saw the report. The report is now under "Archive" in the panel. The webform should have triggered an email, it may be still in the account. You can install the Jotform mobile app and get notifications immediately when a form is submitted, I just did that. I have the credentials to the Jotform admin panel, if you need.

[davimacedo]

@mtrezza what is the e-mail address that the form is sending to? Because security@parseplatform.org was mentioned by @arjun3396 but I believe this e-mail address does not even exist.

[mtrezza]

See Tom's answer:

Should the form send the emails to security[@]parseplatform.org or community@... or do they land in the same inbox anyway?
--
It all ends up in the same inbox, the slight benefit of community@ right now is that the emails get forwarded to me (& Davi and Diamond I assume) so I don’t have to sign into the account to see them.

We also tested that the webform sends an email to the community@.... mailbox.

[davimacedo]

I've just tested again and didn't receive the form in my personal e-mail (not a problem) but did receive in the admin spam box. That's probably what happened with this last report. I will double check the spam box to see if there is something else reported.

[mtrezza]

You mean you didn't receive it in your personal email because it was in the spam box in community@...?

I just checked, we can only add 1 email address for forwarding in the current plan. We could however add Slack integration if that gives it more visibility. I still think the mobile app works best, I just noticed your test submission.

[davimacedo]

I think it is working in the current way we only need to make sure to double check the spam mailbox for the admin account.

[mtrezza]

Or maybe add a rule that moves the email out of spam if possible.

[TomWFox]

I received the submission to a personal email address but didn't see it at the time. Unfortunately it forwards them to an address I no longer use - I still check it but clearly don't see everything!

The slack integration would probably be best for me but if you and Davi will see them in the app/email then that's fine.