CVE-2024-29887
📋 TL;DR
This vulnerability allows man-in-the-middle attacks against Serverpod's non-web HTTP clients by bypassing TLS certificate validation. Attackers can intercept and hijack encrypted traffic between client devices and servers. All users of the serverpod_client package before version 1.2.6 are affected.
💻 Affected Systems
- serverpod_client package
📦 What is this software?
Serverpod by Serverpod
⚠️ Risk & Real-World Impact
Worst Case
Attackers intercept sensitive data (authentication tokens, personal information, business data) transmitted between clients and servers, potentially leading to data breaches, account compromise, or service disruption.
Likely Case
Interception of session tokens or API credentials leading to unauthorized access to backend systems and data exfiltration.
If Mitigated
With proper network segmentation and monitoring, impact is limited to potential data leakage from intercepted sessions.
🎯 Exploit Status
Attack requires ability to intercept network traffic (e.g., compromised network, rogue access point). No authentication needed to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.6
Vendor Advisory: https://github.com/serverpod/serverpod/security/advisories/GHSA-h6x7-r5rg-x5fw
Restart Required: Yes
Instructions:
1. Update pubspec.yaml to require serverpod_client ^1.2.6
2. Run 'flutter pub get' or 'dart pub get'
3. Rebuild and redeploy client applications
4. Restart affected services
🔧 Temporary Workarounds
Network segmentation and monitoring
allIsolate Serverpod traffic to trusted networks and monitor for unusual certificate validation failures
🧯 If You Can't Patch
- Restrict Serverpod client connections to internal/VPN networks only
- Implement certificate pinning at application layer if supported
🔍 How to Verify
Check if Vulnerable:
Check pubspec.lock or package version for serverpod_client <1.2.6Check Version:
grep serverpod_client pubspec.lockVerify Fix Applied:
Confirm serverpod_client version is 1.2.6 or higher in dependencies📡 Detection & Monitoring
Log Indicators:
- Unexpected certificate validation failures
- Connection resets during TLS handshake
Network Indicators:
- Unusual TLS negotiation patterns
- MITM attack signatures in network traffic
SIEM Query:
source="serverpod" AND (event="certificate_validation_failed" OR event="tls_handshake_error")🔗 References
- https://github.com/serverpod/serverpod/commit/d55bf8d12967fc7955a875cb3e0f9693bd6d2c71
- https://github.com/serverpod/serverpod/security/advisories/GHSA-h6x7-r5rg-x5fw
- https://github.com/serverpod/serverpod/commit/d55bf8d12967fc7955a875cb3e0f9693bd6d2c71
- https://github.com/serverpod/serverpod/security/advisories/GHSA-h6x7-r5rg-x5fw
