GHSA-rh9j-f5f8-rvgc BIT-parse-2022-31083 CVE-2022-31083
Authentication bypass vulnerability in Apple Game Center auth adapter
- Severity
- 8.6 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.89%
- Chance of exploitation in the next 30 days. Higher than 59.31% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
4.10.11- Upgrade parse-server to this version or later
Description
Impact
The certificate in Apple Game Center auth adapter not validated. As a result, authentication could potentially be bypassed by making a fake certificate accessible via certain Apple domains and providing the URL to that certificate in an authData object.
Patches
To prevent this, a new rootCertificateUrl property is introduced to the Parse Server Apple Game Center auth adapter which takes the URL to the root certificate of Apple's Game Center authentication certificate. If no value is set, the rootCertificateUrl property defaults to the URL of the current root certificate as of May 27, 2022.
Keep in mind that the root certificate can change at any time (expected to be announced by Apple) and that it is the developer's responsibility to keep the root certificate URL up-to-date when using the Parse Server Apple Game Center auth adapter.
Workarounds
None.
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-rh9j-f5f8-rvgc
- https://developer.apple.com/news/?id=stttq465
- https://github.com/parse-community/parse-server
More information
- For questions or comments about this vulnerability visit our community forum or community chat
- Report other vulnerabilities at report.parseplatform.org
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| parse-server | < 4.10.11 |
4.10.11 |
| parse-server | >= 5.0.0, < 5.2.2 |
5.2.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
parse-server npm → 4.10.11
- npm
npm install parse-server@4.10.11- yarn
yarn add parse-server@4.10.11- pnpm
pnpm add parse-server@4.10.11
Severity breakdown
CVSS 3.1 8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it
- Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
How to prevent it
- Architecture and Design, Implementation: Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
- Implementation: If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
References
Advisories
Packages
Other links
- github.com/parse-community/parse-server/security/advisories/GHSA-rh9j-f5f8-rvgc
- github.com/parse-community/parse-server/pull/8054
- github.com/parse-community/parse-server/pull/8054/commits/0cc299f82e367518f2fe7…
- github.com/parse-community/parse-server/pull/8054/commits/2084b7c569697a5230e42…
- github.com/parse-community/parse-server/commit/ba2b0a9cb9a568817a114b132a4c2e09…
- developer.apple.com/news
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-r899-h629-j84r Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist | Low | Also affects parse-server |
| GHSA-97pr-9hgg-3p8r parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change | Low | Also affects parse-server |
| GHSA-v8x7-r927-cc93 parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist | Low | Also affects parse-server |
| GHSA-cgxm-vr2f-6fj8 parse-server: Denial of service via exponential-time processing of deeply nested query operators | High | Also affects parse-server |
| GHSA-wmwx-jr2p-4j4r parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL | Medium | Also affects parse-server |
| GHSA-75v4-m273-5j49 parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied | Medium | Also affects parse-server |
| GHSA-7wqv-xjf3-x35v parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist | Low | Also affects parse-server |
| GHSA-p84r-h6rx-f2xr parse-server: Server option routeAllowList is bypassable through batch sub-requests | Medium | Also affects parse-server |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor