CVE-2024-29887: Serverpod Auth Bypass Vulnerability

CVE-2024-29887 Overview

CVE-2024-29887 affects Serverpod, an app and web server built for the Flutter and Dart ecosystem. The serverpod_client package disables Transport Layer Security (TLS) certificate validation on all non-web HTTP clients. This allows any presented certificate to be accepted as valid during the TLS handshake. As a result, encrypted traffic between client devices and Serverpod backends is exposed to man-in-the-middle (MITM) attacks. An attacker positioned on the network path can intercept, decrypt, and modify session traffic without triggering certificate errors. The flaw is tracked under CWE-295: Improper Certificate Validation and is resolved in Serverpod 1.2.6.

Critical Impact
Attackers with network position can intercept and tamper with TLS-protected traffic between Serverpod clients and servers, exposing credentials, session tokens, and application data.

Affected Products

Serverpod serverpod_client package versions prior to 1.2.6
Native (non-web) Flutter and Dart HTTP client integrations using Serverpod
Mobile and desktop applications built on the affected Serverpod client

Discovery Timeline

2024-03-27 - CVE-2024-29887 published to the National Vulnerability Database (NVD)
2025-12-19 - Last updated in NVD database

Technical Details for CVE-2024-29887

Vulnerability Analysis

The Serverpod client establishes HTTPS connections using Dart's HttpClient with a configured SecurityContext. The client also registers a badCertificateCallback that unconditionally returns true. That callback short-circuits the platform's TLS chain validation, so the client treats invalid, self-signed, expired, or attacker-controlled certificates as trusted. Because the bypass applies to every non-web client built from serverpod_client, all mobile and desktop apps shipped with vulnerable versions share the defect. An attacker who can place themselves between the client and the server, for example through a hostile Wi-Fi network, rogue access point, or compromised upstream router, can present their own certificate and proxy plaintext traffic through their tooling. The encrypted channel still negotiates successfully, so users and application logs see no TLS error.

Root Cause

The root cause is an explicit override of certificate validation logic inside packages/serverpod_client/lib/src/serverpod_client_io.dart. The badCertificateCallback was left in place from development scaffolding with a TODO to generate working certificates, but it returns true for every certificate, host, and port tuple.

Attack Vector

Exploitation requires network adjacency or control of an intermediate hop between the Serverpod client and server. The attack complexity is elevated because the adversary must intercept and hijack the connection in real time. No user interaction or authentication is required against the Serverpod client itself.

dart

     // Setup client
     _httpClient = HttpClient(context: securityContext);
     _httpClient.connectionTimeout = connectionTimeout;
-
-    // TODO: Generate working certificates
-    _httpClient.badCertificateCallback =
-        ((X509Certificate cert, String host, int port) {
-//      print('Failed to verify server certificate');
-//      print('pem: ${cert.pem}');
-//      print('subject: ${cert.subject}');
-//      print('issuer: ${cert.issuer}');
-//      print('valid from: ${cert.startValidity}');
-//      print('valid to: ${cert.endValidity}');
-//      print('host: $host');
-//      print('port: $port');
-//      return false;
-      return true;
-    });
   }

Source: Serverpod commit d55bf8d. The patch removes the permissive badCertificateCallback, restoring default chain validation provided by the Dart runtime.

Detection Methods for CVE-2024-29887

Indicators of Compromise

Unexpected TLS certificates presented by the Serverpod backend, including self-signed or mismatched-CN certificates accepted by clients without error
Network sessions from Serverpod clients terminating at unfamiliar IP addresses or proxy endpoints prior to reaching the legitimate server
Application telemetry showing successful authenticated sessions originating from atypical geolocations or network paths

Detection Strategies

Inventory deployed Flutter and Dart applications and identify those depending on serverpod_client versions earlier than 1.2.6
Perform active TLS inspection of client traffic in a lab to confirm whether the client rejects untrusted certificates after patching
Hunt in build pipelines and dependency manifests (pubspec.yaml, pubspec.lock) for vulnerable serverpod_client versions

Monitoring Recommendations

Monitor egress flows from mobile and desktop fleets for TLS sessions to non-approved certificate authorities
Alert on Serverpod API authentication anomalies, such as token reuse from new device fingerprints or IP ranges
Track DNS responses for Serverpod backend hostnames to identify resolution poisoning that could enable MITM positioning

How to Mitigate CVE-2024-29887

Immediate Actions Required

Upgrade the serverpod_client dependency to version 1.2.6 or later and rebuild all affected client applications
Force-release updated mobile and desktop clients to end users and deprecate older builds where possible
Rotate any long-lived credentials, API tokens, or session secrets that may have transited vulnerable clients on untrusted networks

Patch Information

The fix is delivered in commit d55bf8d12967fc7955a875cb3e0f9693bd6d2c71 and documented in GitHub Security Advisory GHSA-h6x7-r5rg-x5fw. The patch removes the always-true badCertificateCallback so the Dart HttpClient enforces standard TLS chain validation against the configured SecurityContext.

Workarounds

Restrict client communication to trusted networks, such as corporate VPNs with enforced certificate pinning at the gateway, until clients are upgraded
Deploy server-side certificate pinning or mutual TLS where the application architecture allows, reducing the value of an intercepted session
Disable or block legacy client versions at the Serverpod API layer to prevent vulnerable builds from connecting

bash

# Update the serverpod_client dependency in pubspec.yaml
# Then refresh the lock file and rebuild
dart pub upgrade serverpod_client
dart pub get
dart pub deps | grep serverpod_client  # verify >= 1.2.6