In mid-June 2022, a serious vulnerability was discovered in the open-source server platform Parse Server, which could allow attackers to bypass authentication in Apple Game Center. The problem was that Parse Server did not verify the certificate during authentication via Game Center: the application could accept a fake certificate if an attacker placed it on an accessible URL and passed that URL in the authData parameter when requesting authentication. The vulnerability was assigned the identifier CVE-2022-31083 and was rated 8.6 on the CVSS with a critical threat level.
According to the description on GitHub, the vulnerability occurred because the Apple Game Center adapter in Parse Server did not validate the certificate, allowing an attacker to use a fake certificate accessible via Apple domains and embed its URL in the authData object.
The developers fixed the issue by releasing an update to Parse Server — versions 4.10.11 (and above) and 5.2.2 (and above) — which introduced the rootCertificateUrl option for the Apple Game Center adapter. This property allows you to explicitly specify the URL of the Game Center root certificate, and if no explicit specification is provided, the URL of the current root certificate as of May 27, 2022 is used.
A related issue, identified as CVE-2022-24901, was also discovered, where the Game Center certificate URL validation was also compromised. This vulnerability could have led to authentication bypass and even denial of service (DoS). It was fixed by strengthening URL validation and checking resources before loading them.
The NVD CVSS score for CVE-2022-24901 is 7.5 (High), and GitHub changed the code for improper certificate validation and added additional checks.
Thus, in parallel with CVE-2022-31083, there was another vulnerability (CVE-2022-24901) — similar in cause and mechanics — insufficient verification of the Game Center certificate URL. But in the first case (CVE-2022-31083), it was necessary to update Parse Server to versions 4.10.11 / 5.2.2, and in the second, it was enough to simply improve the validation of URLs and resource data before loading.
The problem had a high degree of risk: an attacker could forge a certificate, gain access to protected resources, bypass the Game Center authentication system, and possibly disrupt server operation. Fixes were released, but there were no alternative temporary protection methods — the only reliable solution was to promptly upgrade to secure versions. In addition, the introduction of rootCertificateUrl makes it important to regularly monitor changes to Apple’s root certificate so that no new vulnerabilities arise due to outdated links.
Conclusion: This incident highlights the importance of not only timely server software updates, but also constant monitoring of critical dependencies (such as root certificates). It was extremely important for developers using Parse Server with Apple Game Center to update to versions 4.10.11 / 5.2.2 (or newer), set the correct rootCertificateUrl, and closely monitor changes in Apple’s infrastructure to prevent similar threats in the future.