PT-2022-3535 · Unknown · Parse Server

Mtrezzapublished + 1 · Published 2022-06-17 · Updated 2024-03-06 · CVE-2022-31083

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 4.10.11 and 5.2.2

Description The issue is related to the lack of validation of the certificate in the Parse Server Apple Game Center auth adapter. This could potentially allow authentication to be bypassed by making a fake certificate accessible via certain Apple domains and providing the URL to that certificate in an authData object.

Recommendations For versions prior to 4.10.11 and 5.2.2, update to version 4.10.11 or 5.2.2 to introduce a new rootCertificateUrl property to the Parse Server Apple Game Center auth adapter, which takes the URL to the root certificate of Apple's Game Center authentication certificate. Ensure the rootCertificateUrl property is kept up-to-date as the root certificate can change at any time.

Exploit

Fix

Improper Authentication

Improper Certificate Validation

Weakness Enumeration

CWE-287

CWE-295

Related Identifiers

BDU:2022-04318

BIT-PARSE-2022-31083

CVE-2022-31083

GHSA-RH9J-F5F8-RVGC

Affected Products

Parse Server

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31083.json · Exploit
• https://github.com/parse-community/parse-server/commit/ba2b0a9cb9a568817a114b132a4c2e0911d76df1 · Patch
• https://github.com/parse-community/parse-server/pull/8054 · Patch
• https://osv.dev/vulnerability/GHSA-rh9j-f5f8-rvgc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31083 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04318 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-31083 · Security Note
• https://osv.dev/vulnerability/BIT-parse-2022-31083 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/security/advisories/GHSA-rh9j-f5f8-rvgc · Note
• https://github.com/parse-community/parse-server/pull/8054/commits/2084b7c569697a5230e42511799eeac9219db5a9 · Note
• https://github.com/parse-community/parse-server/pull/8054/commits/0cc299f82e367518f2fe7a53b99f3f801a338cf4 · Note
• https://t.me/cibsecurity/44754 · Telegram Post
• https://developer.apple.com/news/?id=stttq465 · Note
• https://cybersecurity-help.cz/vdb/SB2022062736 · Note