PT-2023-21302 · Bitwarden · Bitwarden Windows Desktop Application

Mebeim · Published 2023-06-09 · Updated 2025-01-06 · CVE-2023-27706

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Bitwarden Windows desktop application versions prior to v2023.4.0

Description The issue concerns the storage of biometric keys in the Windows Credential Manager by the Bitwarden Windows desktop application, making them accessible to other local unprivileged processes. This highlights challenges in secure password management.

Recommendations For versions prior to v2023.4.0, update to version v2023.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Windows Credential Manager to minimize the risk of exploitation.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2023-27706

Affected Products

Bitwarden Windows Desktop Application

References · 10

• 🔥 https://hackerone.com/reports/1874155 · Exploit
• https://osv.dev/vulnerability/CVE-2023-27706 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27706 · Security Note
• https://github.com/bitwarden/clients/blob/8b5a223ad4ca0f89b6c9bcdbddef464d1755d2c0/apps/desktop/desktop_native/src/biometric/windows.rs#L19 · Note
• https://github.com/bitwarden/clients/blob/8b5a223ad4ca0f89b6c9bcdbddef464d1755d2c0/apps/desktop/desktop_native/src/password/windows.rs#L16 · Note
• https://github.com/bitwarden/clients · Note
• https://twitter.com/payloadartist/status/1742579409356533810 · Twitter Post
• https://t.me/cvenotify/52075 · Telegram Post
• https://twitter.com/nikolozsec/status/1744076497613119985 · Twitter Post
• https://t.me/cvenotify/106413 · Telegram Post