PT-2023-21302 · Bitwarden · Bitwarden Windows Desktop Application

Mebeim · Publicado 2023-06-09 · Atualizado 2025-01-06 · CVE-2023-27706

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Bitwarden Windows desktop application versions prior to v2023.4.0

Description The issue concerns the storage of biometric keys in the Windows Credential Manager by the Bitwarden Windows desktop application, making them accessible to other local unprivileged processes. This highlights challenges in secure password management.

Recommendations For versions prior to v2023.4.0, update to version v2023.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Windows Credential Manager to minimize the risk of exploitation.

Exploit

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

CVE-2023-27706

Produtos afetados

Bitwarden Windows Desktop Application

Referências · 10

• 🔥 https://hackerone.com/reports/1874155 · Exploit
• https://github.com/bitwarden/clients/blob/8b5a223ad4ca0f89b6c9bcdbddef464d1755d2c0/apps/desktop/desktop_native/src/biometric/windows.rs#L19 · Nota
• https://github.com/bitwarden/clients/blob/8b5a223ad4ca0f89b6c9bcdbddef464d1755d2c0/apps/desktop/desktop_native/src/password/windows.rs#L16 · Nota
• https://github.com/bitwarden/clients · Nota
• https://twitter.com/payloadartist/status/1742579409356533810 · Publicação no Twitter
• https://t.me/cvenotify/52075 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-27706 · Aviso do Fabricante
• https://twitter.com/nikolozsec/status/1744076497613119985 · Publicação no Twitter
• https://t.me/cvenotify/106413 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-27706 · Nota de Segurança