CVE-2022-31083
📋 TL;DR
Parse Server's Apple Game Center authentication adapter had a certificate validation flaw that allowed attackers to bypass authentication by providing a fake certificate URL. This affects all Parse Server deployments using Apple Game Center authentication before versions 4.10.11 and 5.2.2. The vulnerability enables unauthorized access to protected resources.
💻 Affected Systems
- Parse Server
📦 What is this software?
Parse Server by Parseplatform
Parse Server by Parseplatform
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass allowing unauthorized users to access protected data and functionality as authenticated users.
Likely Case
Unauthorized access to user accounts and protected resources through Game Center authentication.
If Mitigated
Proper certificate validation prevents all authentication bypass attempts.
🎯 Exploit Status
Requires ability to host fake certificate on Apple domains and craft authData object.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.10.11 or 5.2.2
Vendor Advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-rh9j-f5f8-rvgc
Restart Required: Yes
Instructions:
1. Update Parse Server to version 4.10.11 or 5.2.2. 2. Configure rootCertificateUrl property in Apple Game Center auth adapter. 3. Restart the Parse Server instance.
🔧 Temporary Workarounds
Disable Apple Game Center Authentication
allTemporarily disable Apple Game Center authentication until patching is possible.
Remove or comment out Game Center auth adapter configuration in parse-server config
🧯 If You Can't Patch
- Disable Apple Game Center authentication entirely
- Implement additional authentication layers and monitoring for Game Center auth attempts
🔍 How to Verify
Check if Vulnerable:
Check Parse Server version and verify if using Apple Game Center authentication with versions below 4.10.11 or 5.2.2.Check Version:
npm list parse-serverVerify Fix Applied:
Verify Parse Server version is 4.10.11 or 5.2.2 and rootCertificateUrl is configured in Game Center auth adapter.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication patterns from Game Center
- Failed certificate validation attempts
- Authentication attempts with custom certificate URLs
Network Indicators:
- Requests to non-standard Apple certificate URLs
- Authentication attempts with modified authData objects
SIEM Query:
source="parse-server" AND (event="authentication" AND adapter="gamecenter") AND (certificate_url NOT CONTAINS "apple.com" OR certificate_validation="failed")🔗 References
- https://developer.apple.com/news/?id=stttq465
- https://github.com/parse-community/parse-server/commit/ba2b0a9cb9a568817a114b132a4c2e0911d76df1
- https://github.com/parse-community/parse-server/pull/8054
- https://github.com/parse-community/parse-server/security/advisories/GHSA-rh9j-f5f8-rvgc
- https://developer.apple.com/news/?id=stttq465
- https://github.com/parse-community/parse-server/commit/ba2b0a9cb9a568817a114b132a4c2e0911d76df1
- https://github.com/parse-community/parse-server/pull/8054
- https://github.com/parse-community/parse-server/security/advisories/GHSA-rh9j-f5f8-rvgc
