CVE-2022-31083
Authentication bypass in Parse Server Apple Game Center auth adapter
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in the Parse Server Apple Game Center auth adapter not validated. As a result, authentication could potentially be bypassed by making a fake certificate accessible via certain Apple domains and providing the URL to that certificate in an authData object. Versions 4.0.11 and 5.2.2 prevent this by introducing a new `rootCertificateUrl` property to the Parse Server Apple Game Center auth adapter which takes the URL to the root certificate of Apple's Game Center authentication certificate. If no value is set, the `rootCertificateUrl` property defaults to the URL of the current root certificate as of May 27, 2022. Keep in mind that the root certificate can change at any time and that it is the developer's responsibility to keep the root certificate URL up-to-date when using the Parse Server Apple Game Center auth adapter. There are no known workarounds for this issue.
Parse Server es un backend de código abierto que puede desplegarse en cualquier infraestructura que pueda ejecutar Node.js. En versiones anteriores a 4.10.11 y 5.2.2, el certificado en el adaptador de autenticación de Apple Game Center de Parse Server no es comprobado. Como resultado, la autenticación podía ser potencialmente omitida al hacer un certificado falso accesible por medio de determinados dominios de Apple y proporcionando la URL a ese certificado en un objeto authData. Las versiones 4.0.11 y 5.2.2 evitan esto introduciendo una nueva propiedad "rootCertificateUrl" en el adaptador de autenticación de Apple Game Center de Parse Server que toma la URL del certificado root del certificado de autenticación de Apple Game Center. Si no es establecido ningún valor, la propiedad "rootCertificateUrl" toma por defecto la URL del certificado root actual a fecha de 27 de mayo de 2022. Ten en cuenta que el certificado root puede cambiar en cualquier momento y que es responsabilidad del desarrollador mantener actualizada la URL del certificado root cuando es usado el adaptador de autenticación de Game Center de Parse Server. No se presentan mitigaciones conocidas para este problema
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-05-18 CVE Reserved
- 2022-06-17 CVE Published
- 2024-01-08 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-287: Improper Authentication
- CWE-295: Improper Certificate Validation
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| https://developer.apple.com/news/?id=stttq465 | Third Party Advisory | |
| https://github.com/parse-community/parse-server/security/advisories/GHSA-rh9j-f5f8-rvgc | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/parse-community/parse-server/commit/ba2b0a9cb9a568817a114b132a4c2e0911d76df1 | 2023-06-29 | |
| https://github.com/parse-community/parse-server/pull/8054 | 2023-06-29 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Parseplatform Search vendor "Parseplatform" | Parse-server Search vendor "Parseplatform" for product "Parse-server" | < 4.10.11 Search vendor "Parseplatform" for product "Parse-server" and version " < 4.10.11" | node.js |
Affected
| ||||||
| Parseplatform Search vendor "Parseplatform" | Parse-server Search vendor "Parseplatform" for product "Parse-server" | >= 5.0.0 < 5.2.2 Search vendor "Parseplatform" for product "Parse-server" and version " >= 5.0.0 < 5.2.2" | node.js |
Affected
| ||||||