Skip to content

Commit 145838d

Browse files
mtrezzamtrezza
authored
fix: certificate in Apple Game Center auth adapter not validated; this fixes a security vulnerability in which authentication could be bypassed using a fake certificate; if you are using the Apple Gamer Center auth adapter it is your responsibility to keep its root certificate up-to-date and we advice you read the security advisory ([GHSA-rh9j-f5f8-rvgc](GHSA-rh9j-f5f8-rvgc))
2 parents b00b041 + 8580a52 commit 145838d

4 files changed

Lines changed: 248 additions & 32 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,8 @@ jobs:
4343
PARSE_SERVER_TEST_CACHE: ${{ matrix.PARSE_SERVER_TEST_CACHE }}
4444
NODE_VERSION: ${{ matrix.NODE_VERSION }}
4545
steps:
46+
- name: Fix usage of insecure GitHub protocol
47+
run: sudo git config --system url."https://github".insteadOf "git://github"
4648
- uses: actions/checkout@v2
4749
- name: Use Node.js ${{ matrix.NODE_VERSION }}
4850
uses: actions/setup-node@v1
@@ -89,6 +91,8 @@ jobs:
8991
POSTGRES_MAJOR_VERSION: 11
9092
PARSE_SERVER_TEST_DATABASE_URI: postgres://postgres:postgres@localhost:5432/parse_server_postgres_adapter_test_database
9193
steps:
94+
- name: Fix usage of insecure GitHub protocol
95+
run: sudo git config --system url."https://github".insteadOf "git://github"
9296
- uses: actions/checkout@v2
9397
- name: Use Node.js 10
9498
uses: actions/setup-node@v1

‎spec/AuthenticationAdapters.spec.js‎

Lines changed: 136 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1644,8 +1644,41 @@ describe('apple signin auth adapter', () => {
16441644

16451645
describe('Apple Game Center Auth adapter', () => {
16461646
const gcenter = require('../lib/Adapters/Auth/gcenter');
1647-
1647+
const fs = require('fs');
1648+
const testCert = fs.readFileSync(__dirname + '/support/cert/game_center.pem');
1649+
it('can load adapter', async () => {
1650+
const options = {
1651+
gcenter: {
1652+
rootCertificateUrl:
1653+
'https://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt.pem',
1654+
},
1655+
};
1656+
const { adapter, appIds, providerOptions } = authenticationLoader.loadAuthAdapter(
1657+
'gcenter',
1658+
options
1659+
);
1660+
await adapter.validateAppId(
1661+
appIds,
1662+
{ publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-4.cer' },
1663+
providerOptions
1664+
);
1665+
});
16481666
it('validateAuthData should validate', async () => {
1667+
const options = {
1668+
gcenter: {
1669+
rootCertificateUrl:
1670+
'https://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt.pem',
1671+
},
1672+
};
1673+
const { adapter, appIds, providerOptions } = authenticationLoader.loadAuthAdapter(
1674+
'gcenter',
1675+
options
1676+
);
1677+
await adapter.validateAppId(
1678+
appIds,
1679+
{ publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-4.cer' },
1680+
providerOptions
1681+
);
16491682
// real token is used
16501683
const authData = {
16511684
id: 'G:1965586982',
@@ -1656,29 +1689,49 @@ describe('Apple Game Center Auth adapter', () => {
16561689
salt: 'DzqqrQ==',
16571690
bundleId: 'cloud.xtralife.gamecenterauth',
16581691
};
1659-
1692+
gcenter.cache['https://static.gc.apple.com/public-key/gc-prod-4.cer'] = testCert;
16601693
await gcenter.validateAuthData(authData);
16611694
});
16621695

16631696
it('validateAuthData invalid signature id', async () => {
1697+
const { adapter, appIds, providerOptions } = authenticationLoader.loadAuthAdapter(
1698+
'gcenter',
1699+
{}
1700+
);
1701+
await adapter.validateAppId(
1702+
appIds,
1703+
{ publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-4.cer' },
1704+
providerOptions
1705+
);
16641706
const authData = {
16651707
id: 'G:1965586982',
1666-
publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-4.cer',
1708+
publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-6.cer',
16671709
timestamp: 1565257031287,
16681710
signature: '1234',
16691711
salt: 'DzqqrQ==',
1670-
bundleId: 'cloud.xtralife.gamecenterauth',
1712+
bundleId: 'com.example.com',
16711713
};
1672-
1673-
try {
1674-
await gcenter.validateAuthData(authData);
1675-
fail();
1676-
} catch (e) {
1677-
expect(e.message).toBe('Apple Game Center - invalid signature');
1678-
}
1714+
await expectAsync(gcenter.validateAuthData(authData)).toBeRejectedWith(
1715+
new Parse.Error(Parse.Error.SCRIPT_FAILED, 'Apple Game Center - invalid signature')
1716+
);
16791717
});
16801718

16811719
it('validateAuthData invalid public key http url', async () => {
1720+
const options = {
1721+
gcenter: {
1722+
rootCertificateUrl:
1723+
'https://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt.pem',
1724+
},
1725+
};
1726+
const { adapter, appIds, providerOptions } = authenticationLoader.loadAuthAdapter(
1727+
'gcenter',
1728+
options
1729+
);
1730+
await adapter.validateAppId(
1731+
appIds,
1732+
{ publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-4.cer' },
1733+
providerOptions
1734+
);
16821735
const publicKeyUrls = [
16831736
'example.com',
16841737
'http://static.gc.apple.com/public-key/gc-prod-4.cer',
@@ -1706,6 +1759,78 @@ describe('Apple Game Center Auth adapter', () => {
17061759
)
17071760
);
17081761
});
1762+
1763+
it('should not validate Symantec Cert', async () => {
1764+
const options = {
1765+
gcenter: {
1766+
rootCertificateUrl:
1767+
'https://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt.pem',
1768+
},
1769+
};
1770+
const { adapter, appIds, providerOptions } = authenticationLoader.loadAuthAdapter(
1771+
'gcenter',
1772+
options
1773+
);
1774+
await adapter.validateAppId(
1775+
appIds,
1776+
{ publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-4.cer' },
1777+
providerOptions
1778+
);
1779+
expect(() =>
1780+
gcenter.verifyPublicKeyIssuer(
1781+
testCert,
1782+
'https://static.gc.apple.com/public-key/gc-prod-4.cer'
1783+
)
1784+
);
1785+
});
1786+
1787+
it('adapter should load default cert', async () => {
1788+
const options = {
1789+
gcenter: {},
1790+
};
1791+
const { adapter, appIds, providerOptions } = authenticationLoader.loadAuthAdapter(
1792+
'gcenter',
1793+
options
1794+
);
1795+
await adapter.validateAppId(
1796+
appIds,
1797+
{ publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-4.cer' },
1798+
providerOptions
1799+
);
1800+
const previous = new Date();
1801+
await adapter.validateAppId(
1802+
appIds,
1803+
{ publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-4.cer' },
1804+
providerOptions
1805+
);
1806+
1807+
const duration = new Date().getTime() - previous.getTime();
1808+
expect(duration).toEqual(0);
1809+
});
1810+
1811+
it('adapter should throw', async () => {
1812+
const options = {
1813+
gcenter: {
1814+
rootCertificateUrl: 'https://example.com',
1815+
},
1816+
};
1817+
const { adapter, appIds, providerOptions } = authenticationLoader.loadAuthAdapter(
1818+
'gcenter',
1819+
options
1820+
);
1821+
await expectAsync(
1822+
adapter.validateAppId(
1823+
appIds,
1824+
{ publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-4.cer' },
1825+
providerOptions
1826+
)
1827+
).toBeRejectedWith(
1828+
new Parse.Error(
1829+
Parse.Error.OBJECT_NOT_FOUND,
1830+
'Apple Game Center auth adapter parameter `rootCertificateURL` is invalid.'
1831+
)
1832+
);
1833+
});
17091834
});
17101835

17111836
describe('phant auth adapter', () => {

‎spec/support/cert/game_center.pem‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIEvDCCA6SgAwIBAgIQXRHxNXkw1L9z5/3EZ/T/hDANBgkqhkiG9w0BAQsFADB/
3+
MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAd
4+
BgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxMDAuBgNVBAMTJ1N5bWFudGVj
5+
IENsYXNzIDMgU0hBMjU2IENvZGUgU2lnbmluZyBDQTAeFw0xODA5MTcwMDAwMDBa
6+
Fw0xOTA5MTcyMzU5NTlaMHMxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9y
7+
bmlhMRIwEAYDVQQHDAlDdXBlcnRpbm8xFDASBgNVBAoMC0FwcGxlLCBJbmMuMQ8w
8+
DQYDVQQLDAZHQyBTUkUxFDASBgNVBAMMC0FwcGxlLCBJbmMuMIIBIjANBgkqhkiG
9+
9w0BAQEFAAOCAQ8AMIIBCgKCAQEA06fwIi8fgKrTQu7cBcFkJVF6+Tqvkg7MKJTM
10+
IOYPPQtPF3AZYPsbUoRKAD7/JXrxxOSVJ7vU1mP77tYG8TcUteZ3sAwvt2dkRbm7
11+
ZO6DcmSggv1Dg4k3goNw4GYyCY4Z2/8JSmsQ80Iv/UOOwynpBziEeZmJ4uck6zlA
12+
17cDkH48LBpKylaqthym5bFs9gj11pto7mvyb5BTcVuohwi6qosvbs/4VGbC2Nsz
13+
ie416nUZfv+xxoXH995gxR2mw5cDdeCew7pSKxEhvYjT2nVdQF0q/hnPMFnOaEyT
14+
q79n3gwFXyt0dy8eP6KBF7EW9J6b7ubu/j7h+tQfxPM+gTXOBQIDAQABo4IBPjCC
15+
ATowCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUH
16+
AwMwYQYDVR0gBFowWDBWBgZngQwBBAEwTDAjBggrBgEFBQcCARYXaHR0cHM6Ly9k
17+
LnN5bWNiLmNvbS9jcHMwJQYIKwYBBQUHAgIwGQwXaHR0cHM6Ly9kLnN5bWNiLmNv
18+
bS9ycGEwHwYDVR0jBBgwFoAUljtT8Hkzl699g+8uK8zKt4YecmYwKwYDVR0fBCQw
19+
IjAgoB6gHIYaaHR0cDovL3N2LnN5bWNiLmNvbS9zdi5jcmwwVwYIKwYBBQUHAQEE
20+
SzBJMB8GCCsGAQUFBzABhhNodHRwOi8vc3Yuc3ltY2QuY29tMCYGCCsGAQUFBzAC
21+
hhpodHRwOi8vc3Yuc3ltY2IuY29tL3N2LmNydDANBgkqhkiG9w0BAQsFAAOCAQEA
22+
I/j/PcCNPebSAGrcqSFBSa2mmbusOX01eVBg8X0G/z8Z+ZWUfGFzDG0GQf89MPxV
23+
woec+nZuqui7o9Bg8s8JbHV0TC52X14CbTj9w/qBF748WbH9gAaTkrJYPm+MlNhu
24+
tjEuQdNl/YXVMvQW4O8UMHTi09GyJQ0NC4q92Wxvx1m/qzjvTLvrXHGQ9pEHhPyz
25+
vfBLxQkWpNoCNKU7UeESyH06XOrGc9MsII9deeKsDJp9a0jtx+pP4MFVtFME9SSQ
26+
tMBs0It7WwEf7qcRLpialxKwY2EzQ9g4WnANHqo18PrDBE10TFpZPzUh7JhMViVr
27+
EEbl0YdElmF8Hlamah/yNw==
28+
-----END CERTIFICATE-----

‎src/Adapters/Auth/gcenter.js‎

Lines changed: 80 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,8 @@ const authData = {
1414
const { Parse } = require('parse/node');
1515
const crypto = require('crypto');
1616
const https = require('https');
17-
17+
const { pki } = require('node-forge');
18+
const ca = { cert: null, url: null };
1819
const cache = {}; // (publicKey -> cert) cache
1920

2021
function verifyPublicKeyUrl(publicKeyUrl) {
@@ -52,39 +53,53 @@ async function getAppleCertificate(publicKeyUrl) {
5253
path: url.pathname,
5354
method: 'HEAD',
5455
};
55-
const headers = await new Promise((resolve, reject) =>
56+
const cert_headers = await new Promise((resolve, reject) =>
5657
https.get(headOptions, res => resolve(res.headers)).on('error', reject)
5758
);
59+
const validContentTypes = ['application/x-x509-ca-cert', 'application/pkix-cert'];
5860
if (
59-
headers['content-type'] !== 'application/pkix-cert' ||
60-
headers['content-length'] == null ||
61-
headers['content-length'] > 10000
61+
!validContentTypes.includes(cert_headers['content-type']) ||
62+
cert_headers['content-length'] == null ||
63+
cert_headers['content-length'] > 10000
6264
) {
6365
throw new Parse.Error(
6466
Parse.Error.OBJECT_NOT_FOUND,
6567
`Apple Game Center - invalid publicKeyUrl: ${publicKeyUrl}`
6668
);
6769
}
70+
const { certificate, headers } = await getCertificate(publicKeyUrl);
71+
if (headers['cache-control']) {
72+
const expire = headers['cache-control'].match(/max-age=([0-9]+)/);
73+
if (expire) {
74+
cache[publicKeyUrl] = certificate;
75+
// we'll expire the cache entry later, as per max-age
76+
setTimeout(() => {
77+
delete cache[publicKeyUrl];
78+
}, parseInt(expire[1], 10) * 1000);
79+
}
80+
}
81+
return verifyPublicKeyIssuer(certificate, publicKeyUrl);
82+
}
83+
84+
function getCertificate(url, buffer) {
6885
return new Promise((resolve, reject) => {
6986
https
70-
.get(publicKeyUrl, res => {
71-
let data = '';
87+
.get(url, res => {
88+
const data = [];
7289
res.on('data', chunk => {
73-
data += chunk.toString('base64');
90+
data.push(chunk);
7491
});
7592
res.on('end', () => {
76-
const cert = convertX509CertToPEM(data);
77-
if (res.headers['cache-control']) {
78-
var expire = res.headers['cache-control'].match(/max-age=([0-9]+)/);
79-
if (expire) {
80-
cache[publicKeyUrl] = cert;
81-
// we'll expire the cache entry later, as per max-age
82-
setTimeout(() => {
83-
delete cache[publicKeyUrl];
84-
}, parseInt(expire[1], 10) * 1000);
85-
}
93+
if (buffer) {
94+
resolve({ certificate: Buffer.concat(data), headers: res.headers });
95+
return;
8696
}
87-
resolve(cert);
97+
let cert = '';
98+
for (const chunk of data) {
99+
cert += chunk.toString('base64');
100+
}
101+
const certificate = convertX509CertToPEM(cert);
102+
resolve({ certificate, headers: res.headers });
88103
});
89104
})
90105
.on('error', reject);
@@ -115,6 +130,30 @@ function verifySignature(publicKey, authData) {
115130
}
116131
}
117132

133+
function verifyPublicKeyIssuer(cert, publicKeyUrl) {
134+
const publicKeyCert = pki.certificateFromPem(cert);
135+
if (!ca.cert) {
136+
throw new Parse.Error(
137+
Parse.Error.OBJECT_NOT_FOUND,
138+
'Apple Game Center auth adapter parameter `rootCertificateURL` is invalid.'
139+
);
140+
}
141+
try {
142+
if (!ca.cert.verify(publicKeyCert)) {
143+
throw new Parse.Error(
144+
Parse.Error.OBJECT_NOT_FOUND,
145+
`Apple Game Center - invalid publicKeyUrl: ${publicKeyUrl}`
146+
);
147+
}
148+
} catch (e) {
149+
throw new Parse.Error(
150+
Parse.Error.OBJECT_NOT_FOUND,
151+
`Apple Game Center - invalid publicKeyUrl: ${publicKeyUrl}`
152+
);
153+
}
154+
return cert;
155+
}
156+
118157
// Returns a promise that fulfills if this user id is valid.
119158
async function validateAuthData(authData) {
120159
if (!authData.id) {
@@ -126,11 +165,31 @@ async function validateAuthData(authData) {
126165
}
127166

128167
// Returns a promise that fulfills if this app id is valid.
129-
function validateAppId() {
130-
return Promise.resolve();
168+
async function validateAppId(appIds, authData, options = {}) {
169+
if (!options.rootCertificateUrl) {
170+
options.rootCertificateUrl =
171+
'https://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt.pem';
172+
}
173+
if (ca.url === options.rootCertificateUrl) {
174+
return;
175+
}
176+
const { certificate, headers } = await getCertificate(options.rootCertificateUrl, true);
177+
if (
178+
headers['content-type'] !== 'application/x-pem-file' ||
179+
headers['content-length'] == null ||
180+
headers['content-length'] > 10000
181+
) {
182+
throw new Parse.Error(
183+
Parse.Error.OBJECT_NOT_FOUND,
184+
'Apple Game Center auth adapter parameter `rootCertificateURL` is invalid.'
185+
);
186+
}
187+
ca.cert = pki.certificateFromPem(certificate);
188+
ca.url = options.rootCertificateUrl;
131189
}
132190

133191
module.exports = {
134192
validateAppId,
135193
validateAuthData,
194+
cache,
136195
};

0 commit comments

Comments
 (0)