CVE-2022-24901: Apple Game Center Authentication Adapter Improper Validation
Summary
CVE-2022-24901: Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter. Affects parse across 2 version ranges.
< 4.10.10
>= 5.0.0, < 5.2.1
Fixed in 4.10.10 or 5.2.1, depending on the release line you run. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2022-24901 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Parse Server is an open-source backend framework that allows developers to build scalable and customizable applications. It provides features such as data storage, user authentication, and push notifications. The Apple Game Center authentication adapter is a component of the Parse Server that enables users to authenticate using their Apple Game Center credentials. This adapter validates the Apple certificate URL to ensure the authenticity of the authentication process.
Vulnerability Detail
The vulnerability (CVE-2022-24901) arises from improper validation of the Apple certificate URL in the Apple Game Center authentication adapter. Attackers can exploit this flaw to bypass authentication, making the server vulnerable to denial-of-service (DoS) attacks. By bypassing authentication, malicious actors can overload the server with requests, leading to service disruption. To address this vulnerability, the Parse Server team has improved the URL validation process and added additional checks to verify the resource the URL points to before downloading it.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.10.104.10.10 -
>= 5.0.0, < 5.2.15.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general security practice, it is advisable to implement additional security measures such as rate limiting and request throttling to mitigate the risk of DoS attacks.
Conclusion
The vulnerability in the Apple Game Center authentication adapter of the Parse Server allows attackers to bypass authentication and launch DoS attacks. To mitigate this risk, it is essential to update the Parse Server to the recommended versions and implement additional security measures. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for parse →
FAQ
This vulnerability allows attackers to bypass authentication and launch DoS attacks, potentially leading to service disruption and unavailability of the Parse Server.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, including the Parse Server, using a manifest file like package-lock.json.
No, not all versions of the Parse Server are affected. The vulnerability was introduced in version 0 and fixed in version 4.10.10 and 5.2.1. It is recommended to update to these versions or later to ensure the vulnerability is addressed.
There is no known public exploit for this vulnerability at the time of this report. However, it is crucial to apply the necessary updates and security measures to mitigate the risk.
You can find more information about this vulnerability, including technical details and the fix, in the vulnerability report on the Bitnami Vulnerability Database: [link to the vulnerability report].
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
