CVE-2022-31083: Open Source Vulnerability in Parse Server
Summary
CVE-2022-31083: Authentication bypass in Parse Server Apple Game Center auth adapter. Affects parse across 2 version ranges.
< 4.10.11
>= 5.0.0, < 5.2.2
Fixed in 4.10.11 or 5.2.2, depending on the release line you run. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2022-31083 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open source backend that can be deployed to any infrastructure running Node.js. It provides a platform for building scalable and secure applications. However, versions prior to 4.10.11 and 5.2.2 of Parse Server are vulnerable to a certificate validation issue in the Apple Game Center auth adapter. This vulnerability allows authentication to be bypassed by using a fake certificate accessible via certain Apple domains. The Parse Server Apple Game Center auth adapter does not validate the certificate, making it possible for an attacker to provide a URL to a fake certificate in an authData object. This can lead to unauthorized access and potential security breaches.
Vulnerability Detail
The vulnerability in Parse Server arises from the lack of certificate validation in the Apple Game Center auth adapter. By exploiting this issue, an attacker can bypass authentication by providing a URL to a fake certificate. This can be achieved by making the fake certificate accessible via specific Apple domains. The impact of this vulnerability is significant as it allows unauthorized access to the system, potentially compromising sensitive data and undermining the security of the application. Versions 4.0.11 and 5.2.2 of Parse Server address this vulnerability by introducing a new rootCertificateUrl property in the Apple Game Center auth adapter, which allows developers to specify the URL of the root certificate for Apple's Game Center authentication. It is crucial for developers to keep the root certificate URL up-to-date to ensure the security of the authentication process.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.10.114.10.11 -
>= 5.0.0, < 5.2.25.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to update Parse Server to the fixed versions and configure the rootCertificateUrl property correctly to prevent potential authentication bypass.
Conclusion
The vulnerability in Parse Server's Apple Game Center auth adapter can lead to authentication bypass and unauthorized access. It is crucial to update Parse Server to the fixed versions and configure the rootCertificateUrl property correctly to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for parse →
FAQ
Parse Server is an open source backend that can be deployed to any infrastructure running Node.js. It provides a platform for building scalable and secure applications.
This vulnerability allows authentication to be bypassed, potentially leading to unauthorized access and security breaches.
Versions prior to 4.10.11 and 5.2.2 of Parse Server are affected by this vulnerability.
To fix this vulnerability, update Parse Server to version 4.10.11 or 5.2.2 and ensure the rootCertificateUrl property is correctly configured.
No, there are no known workarounds for this vulnerability. Updating Parse Server is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for parse.
