CVE-2024-29887

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the `serverpod_client` package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic and highjack the connection to the server for this vulnerability to be used. Upgrading to version `1.2.6` resolves this issue.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/serverpod/serverpod/commit/d55bf8d12967fc7955a875cb3e0f9693bd6d2c71
https://github.com/serverpod/serverpod/security/advisories/GHSA-h6x7-r5rg-x5fw

Configurations

No configuration.

History

No history.

Information

Published : 2024-03-27 19:15

Updated : 2024-03-28 02:01

NVD link : CVE-2024-29887

Mitre link : CVE-2024-29887

CVE.ORG link : CVE-2024-29887

JSON object : View

Products Affected

No product.

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2024-29887", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "published": "2024-03-27T19:15:49.230", "references": [{"url": "https://github.com/serverpod/serverpod/commit/d55bf8d12967fc7955a875cb3e0f9693bd6d2c71", "source": "security-advisories@github.com"}, {"url": "https://github.com/serverpod/serverpod/security/advisories/GHSA-h6x7-r5rg-x5fw", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the `serverpod_client` package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic and highjack the connection to the server for this vulnerability to be used. Upgrading to version `1.2.6` resolves this issue.\n\n"}, {"lang": "es", "value": "Serverpod es una aplicaci\u00f3n y un servidor web, creado para el ecosistema Flutter y Dart. Este error omiti\u00f3 la validaci\u00f3n de los certificados TSL en todos los clientes HTTP que no son web en el paquete `serverpod_client`. Haci\u00e9ndolos susceptibles a un ataque de intermediario contra el tr\u00e1fico cifrado entre el dispositivo cliente y el servidor. Un atacante tendr\u00eda que poder interceptar el tr\u00e1fico y secuestrar la conexi\u00f3n al servidor para poder utilizar esta vulnerabilidad. La actualizaci\u00f3n a la versi\u00f3n `1.2.6` resuelve este problema."}], "lastModified": "2024-03-28T02:01:13.303", "sourceIdentifier": "security-advisories@github.com"}