CVE-2024-29886: Serverpod Password Hash Vulnerability

CVE-2024-29886 Overview

Serverpod, an app and web server built for the Flutter and Dart ecosystem, contains a weak password hashing vulnerability in versions prior to 1.2.6. The legacy password hash algorithm is susceptible to rainbow table attacks if the underlying database is compromised. An attacker with database access could recover user credentials by precomputing hash tables against the weak hashing scheme. The maintainers addressed the issue by updating the password hashing algorithm and introducing salt and pepper primitives for email authentication.

Critical Impact
If the Serverpod database is compromised, attackers can leverage rainbow tables to recover plaintext passwords, enabling account takeover and lateral access to protected resources.

Affected Products

Serverpod versions prior to 1.2.6
serverpod_auth_server module (email authentication component)
Applications built on the Serverpod framework using the legacy password hash

Discovery Timeline

2024-03-27 - CVE-2024-29886 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29886

Vulnerability Analysis

The flaw is classified as [CWE-916]: Use of Password Hash With Insufficient Computational Effort. Serverpod's legacy email authentication module hashed user passwords using an algorithm that did not provide adequate resistance to precomputed dictionary and rainbow table attacks. When combined with a static or predictable salt, attackers who obtain a copy of the credential store can efficiently reverse hashes into plaintext passwords offline.

The issue does not require authentication or user interaction to exploit once database access is achieved. Exploitation depends on a secondary compromise, such as SQL injection, backup exfiltration, or insider access to the database.

Root Cause

The root cause is the use of a password hashing scheme with insufficient computational cost and inadequate cryptographic salting. The original implementation relied on a shared static salt string, making all hashes vulnerable to a single precomputed rainbow table. Modern password hashing requires per-user random salts, a server-side pepper, and a slow, memory-hard function such as Argon2 or bcrypt.

Attack Vector

An attacker who gains read access to the Serverpod database extracts the stored password hashes. Because the hashes were generated with a weak algorithm and a known or guessable salt, the attacker uses precomputed rainbow tables or GPU-accelerated cracking to recover plaintext passwords. Recovered credentials enable account takeover, credential stuffing against other services, and privileged access within the application.

text

// Patch excerpt: modules/serverpod_auth/serverpod_auth_server/lib/src/business/config.dart
   /// Default is 8 characters.
   final int minPasswordLength;
 
+  /// True if unsecure random number generation is allowed. If set to false, an
+  /// error will be thrown if the platform does not support secure random number
+  /// generation. Default is true but will be changed to false in Serverpod 2.0.
+  final bool allowUnsecureRandom;
+
   /// Creates a new Auth configuration. Use the [set] method to replace the
   /// default settings. Defaults to `config/firebase_service_account_key.json`.
   AuthConfig({

Source: Serverpod commit a78b9e9

The patch also introduces an EmailSecrets abstraction that separates the legacy salt from a new server-side pepper retrieved through Serverpod.instance.getPassword('emailPasswordPepper'), allowing operators to inject a secret that is never stored alongside the hashes.

Detection Methods for CVE-2024-29886

Indicators of Compromise

Unexpected read queries against the serverpod_auth user tables or full-table exports of credential columns.
Successful logins from anomalous geolocations or IP addresses shortly after a suspected database exposure event.
Access to database backup files or snapshots by non-administrative accounts.

Detection Strategies

Inventory all Serverpod deployments and identify instances running versions prior to 1.2.6 by inspecting pubspec.yaml or pubspec.lock.
Review authentication logs for bursts of failed logins followed by a successful login, which is characteristic of offline cracking followed by credential reuse.
Monitor database audit logs for unusual bulk read operations against authentication tables.

Monitoring Recommendations

Enable database-level query auditing on tables that hold password hashes and alert on non-application service accounts reading them.
Correlate application authentication events with database access events to detect out-of-band credential exfiltration.
Track dependency versions in CI pipelines and alert when Serverpod versions below 1.2.6 are introduced.

How to Mitigate CVE-2024-29886

Immediate Actions Required

Upgrade Serverpod to version 1.2.6 or later across all environments.
Rotate the email_password_salt and configure a strong emailPasswordPepper secret using Serverpod.instance.getPassword.
Force a password reset for all existing users so credentials are re-hashed with the updated algorithm.
Review database access controls and rotate any credentials that may have been exposed to unauthorized parties.

Patch Information

The fix is delivered in Serverpod 1.2.6. Technical details are available in the GitHub Security Advisory GHSA-r75m-26cq-mjxc and the corresponding remediation commit a78b9e9.

Workarounds

If immediate upgrade is not possible, restrict database access to the minimum required service accounts and enforce network-level segmentation.
Encrypt database backups at rest and require multi-party approval to access them.
Enforce multi-factor authentication so that recovered passwords alone cannot compromise an account.

bash

# Update Serverpod dependency to the patched release
dart pub upgrade serverpod:^1.2.6
dart pub upgrade serverpod_auth_server:^1.2.6

# Configure the pepper secret used by the patched EmailSecrets class
# Add the value to your Serverpod passwords configuration file
# config/passwords.yaml
# emailPasswordPepper: "<generated-32-byte-random-secret>"