CVE-2024-29887 (published 2024-03-27T19:15Z)

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the `serverpod_client` package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic and highjack the connection to the server for this vulnerability to be used. Upgrading to version `1.2.6` resolves this issue.\n\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/serverpod/serverpod
commit_details: repo_url: https://github.com/serverpod/serverpod
author: Isak
author_date: 2024-03-22 15:28:28+01:00
msg: fix: Remove faulty certificate check. (#2041)
repository: repo_url: https://github.com/serverpod/serverpod
repo_name: serverpod/serverpod
description: Serverpod is a next-generation app and web server, explicitly built for the Flutter and Dart ecosystem.
repo_language: Dart
owner: serverpod
file_changes: filename: serverpod_client_io.dart
change_type: ModificationType.MODIFY
diff: @@ -35,21 +35,6 @@ abstract class ServerpodClient extends ServerpodClientShared {
     // Setup client
     _httpClient = HttpClient(context: securityContext);
     _httpClient.connectionTimeout = connectionTimeout;
-
-    // TODO: Generate working certificates
-    _httpClient.badCertificateCallback =
-        ((X509Certificate cert, String host, int port) {
-//      print('Failed to verify server certificate');
-//      print('pem: ${cert.pem}');
-//      print('subject: ${cert.subject}');
-//      print('issuer: ${cert.issuer}');
-//      print('valid from: ${cert.startValidity}');
-//      print('valid to: ${cert.endValidity}');
-//      print('host: $host');
-//      print('port: $port');
-//      return false;
-      return true;
-    });
   }
 
   Future<void> _initialize() async {

programming_language: TypeScript
filename: tsl_client_test.dart
change_type: ModificationType.ADD
diff: @@ -0,0 +1,31 @@
+import 'dart:io';
+
+import 'package:serverpod_service_client/serverpod_service_client.dart';
+import 'package:test/test.dart';
+
+void main() {
+  test(
+      'Given valid certificates when a call to the health endpoint of a service with a valid certificate then the requests completes successfully.',
+      () async {
+    var client = Client('https://api.serverpod.app/');
+
+    expectLater(
+      client.callServerEndpoint<void>('', '', {}),
+      completes,
+    );
+  });
+
+  test(
+      'Given no valid certificates when a call to the health endpoint of a service then the requests is rejected with a handshake exception.',
+      () async {
+    var client = Client(
+      'https://api.serverpod.app/',
+      securityContext: SecurityContext(withTrustedRoots: false),
+    );
+
+    expectLater(
+      client.callServerEndpoint<void>('', '', {}),
+      throwsA(isA<HandshakeException>()),
+    );
+  });
+}

programming_language: TypeScript