Executive brief
Apollos Project is a platform that provides church-related apps and authentication services. A vulnerability in its person record auto-merging functionality allows new user registrations to gain unauthorized access to existing user accounts by knowing only basic public information like name, birthday, and gender, compromising access to the entire app and any authenticated web links.
Technical details
The vulnerability exists in the auto-merge functionality of the data-connector-rock library, which automatically merges new registrations with existing person records based on profile information. An attacker can create a new account using publicly available or guessable information about an existing user (name, birthday, gender) and the system will merge the registration with that person's existing account, granting full access. The vulnerability affects all versions prior to 2.20.0. The attack requires network access but only minimal authentication (the ability to register a new account) and no user interaction. Patches are available in v2.20.0 and later, which changed the registration flow to create a duplicate person record rather than auto-merge.
Affected products
- Apollos Project data-connector-rock < 2.20.0
Timeline
- 2021-06-16: disclosed
- 2021-06-21: patched: v2.20.0 released with fix