An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. It lacks an offboarding process for members who leave an organization. As a result, the shared organization key is not rotated when a member departs. Consequently, the departing member, whose access should be revoked, retains a copy of the organization key. Additionally, the application fails to adequately protect some encrypted data stored on the server. Consequently, an authenticated user could gain unauthorized access to encrypted data of any organization, even if the user is not a member of the targeted organization. However, the user would need to know the corresponding organizationId. Hence, if a user (whose access to an organization has been revoked) already possesses the organization key, that user could use the key to decrypt the leaked data.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A vulnerability has been identified
    in the authentication and authorization process of the endpoint responsible for altering the metadata of
    an emergency access. It permits an attacker with granted emergency access to escalate their privileges by
    changing the access level and modifying the wait time. Consequently, the attacker can gain full control
    over the vault (when only intended to have read access) while bypassing the necessary wait period.
    (CVE-2024-39924)

  - An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. It lacks an offboarding process for
    members who leave an organization. As a result, the shared organization key is not rotated when a member
    departs. Consequently, the departing member, whose access should be revoked, retains a copy of the
    organization key. Additionally, the application fails to adequately protect some encrypted data stored on
    the server. Consequently, an authenticated user could gain unauthorized access to encrypted data of any
    organization, even if the user is not a member of the targeted organization. However, the user would need
    to know the corresponding organizationId. Hence, if a user (whose access to an organization has been
    revoked) already possesses the organization key, that user could use the key to decrypt the leaked data.
    (CVE-2024-39925)

  - An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A stored cross-site scripting (XSS)
    or, due to the default CSP, HTML injection vulnerability has been discovered in the admin dashboard. This
    potentially allows an authenticated attacker to inject malicious code into the dashboard, which is then
    executed or rendered in the context of an administrator's browser when viewing the injected content.
    However, it is important to note that the default Content Security Policy (CSP) of the application blocks
    most exploitation paths, significantly mitigating the potential impact. (CVE-2024-39926)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the d2723b0f-58d9-11ef-b611-84a93843eb75 advisory.

    SO-AND-SO reports:
    This release has several CVE Reports fixed and we recommend                 everybody to update to the latest version as soon as possible.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
427538	Alpine: multiple vaultwarden packages: security update to 1.32.0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
427538	Alpine: multiple vaultwarden packages: security update to 1.32.0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
426539	Alpine: multiple vaultwarden packages: security update to 1.32.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
426539	Alpine: multiple vaultwarden packages: security update to 1.32.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
205436	FreeBSD : Vaultwarden -- Multiple vulnerabilities (d2723b0f-58d9-11ef-b611-84a93843eb75)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2024-39925

medium

Tenable Plugins

high

high

high

high

high