Four-year-old iframe flaw allows hackers to steal Bitwarden passwords

Getty Photographs

Bitwarden’s autofill element is made up of a flaw which could let websites to steal users’ passwords.

The password manager browser extension handles embedded iframes on a web site in an atypical manner, according to new investigate from cyber security organization Flashpoint.

Researchers observed that Bitwarden’s browser extension auto-fills forms that are in an embedded iframe even if they are from distinct domains.

Inline frames – ‘iframes’ – are a prevalent part of webpages and section of the HTML markup language. They let web web pages to incorporate content from exterior sources.

numerous distinct sorts of content material can be saved in an iframe, together with basic interfaces with textual content fields to input login qualifications.

“While the embedded iframe does not have entry to any content material in the father or mother web page, it can wait for enter to the login kind and forward the entered qualifications to a distant server without the need of even more consumer conversation,” said Flashpoint.

The scientists defined that they are aware of normal, uncompromised, web sites that use embedded external iframes for a number of causes, like marketing. 

“This signifies that an attacker does not always need to compromise the site itself – they just have to have to be in manage of the iframe content material,” they spelled out.

Irrespective of this, Flashpoint identified that there weren’t several web sites that embedded an iframe on the login website page, which lowers the risk. 

Having said that, it also discovered that default URI matching, which is how a browser extension understands when to automobile-fill logins, combined with unsecured vehicle-fill conduct, can guide to two feasible attack vectors.

The first is if an uncompromised internet site embeds an external iframe, which an attacker controls, and enables the ‘Auto-fill on page load’ alternative. The second is if an attacker hosts a web website page less than a subdomain.

“In our exploration, we confirmed that a few of main websites give this precise atmosphere,” explained Flashpoint. “If a person with a Bitwarden browser extension visits a specifically crafted website page hosted in these web companies, an attacker is able to steal the qualifications stored for the respective domain.”

On making contact with Bitwarden, Flashpoint uncovered, to its shock, that the company knew about the issue as significantly back again as November 2018.

Bitwarden released a Security Evaluation Report in which the issue, named BWN-01-001 by the password manager, was specific. Flashpoint researchers stated that this suggests the issue has been documented and community for more than 4 many years.

“Since Bitwarden does not look at every single iframe’s URL, it is feasible for a site to have a destructive iframe embedded which Bitwarden will autofill with the ‘top-level’ website credentials,” the report go through.

“Unfortunately, there are authentic circumstances wherever web-sites will include iframe login forms from a independent area than their ‘parent’ website’s area.”

Bitwarden explained in the report that no motion was planned at the time.

“If a internet site is embedding a malicious iframe from another domain, we can think that web page (or device) is presently in a compromised condition and that efforts from Bitwarden to check out to mitigate the leaking of credentials for that website would very likely not help,” Flashpoint reported. “Additionally, by default Bitwarden does not autofill data without the need of a user’s consent.”

Flashpoint believes that Bitwarden’s 2018 assessment of the issue is invalid, owing to how vital compromised qualifications are for attackers to get accessibility to a user or organisation. Researchers established and offered two illustrations to Bitwarden to present how the issue could be exploited.

Bitwarden confirmed to IT Pro that it has been knowledgeable of the issue since 2018.

“Bitwarden accepts iframe vehicle-filling for the reason that lots of well-liked web sites use this design, for instance icloud.com works by using an iframe from apple.com,” a spokesperson reported. “So there are beautifully legitimate use cases in which login kinds are in an iframe underneath a unique domain.”

The organization extra that the autofill characteristic described by Flashpoint is not enabled by default.

There is also a warning information that seems on the password manager which reads “>Warning: This function is disabled by default simply because, although commonly safe, compromised or untrusted web-sites could get advantage of this to steal credentials”.

Flashpoint said that Bitwarden plans to exclude the documented hosting setting from its car-fill function, but does not plan to make any variations to the way iframes get the job done.

Only 1 attack vector has been dealt with as an alternative of the root trigger of the issue, the researchers said.

“It need to also be observed that a temporary analysis of other password manager extensions reveals that none of those people will automobile-fill iframes from distinctive origins or present warnings for iframes from unique origins. This presently seems to be exceptional to Bitwarden’s products,” they added.

Some elements of this report are sourced from:
www.itpro.co.uk