CVE-2024-55226
📋 TL;DR
Vaultwarden v1.32.5 contains an authenticated reflected cross-site scripting (XSS) vulnerability in the /api/core/mod.rs component. This allows authenticated attackers to inject malicious scripts that execute in victims' browsers when they visit crafted URLs. Only users running Vaultwarden v1.32.5 are affected.
💻 Affected Systems
- Vaultwarden
📦 What is this software?
Vaultwarden by Dani Garcia
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could steal session cookies, perform actions as the victim, or redirect to malicious sites, potentially compromising the entire Vaultwarden instance and sensitive password data.
Likely Case
Attackers with valid credentials could perform limited session hijacking or credential theft against other users who click malicious links.
If Mitigated
With proper input validation and output encoding, the impact is minimal as scripts would be properly sanitized before execution.
🎯 Exploit Status
Exploitation requires authenticated access and victim interaction with crafted URLs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.32.6 or later
Vendor Advisory: https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.6
Restart Required: Yes
Instructions:
1. Stop Vaultwarden service. 2. Update to v1.32.6 or later using your deployment method (Docker, manual install, etc.). 3. Restart Vaultwarden service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall (WAF) rules to filter malicious script patterns in API requests.
# WAF rule example: Block requests containing <script> tags in parameters
# Implementation depends on your WAF (e.g., ModSecurity, Cloudflare, AWS WAF)
🧯 If You Can't Patch
- Restrict access to Vaultwarden to trusted networks only and implement strict authentication controls.
- Monitor logs for unusual API requests to /api/core/mod.rs and educate users about phishing risks.
🔍 How to Verify
Check if Vulnerable:
Check your Vaultwarden version; if it's exactly v1.32.5, you are vulnerable.Check Version:
docker exec vaultwarden vaultwarden --version # For Docker; or check your deployment methodVerify Fix Applied:
After updating, confirm the version is v1.32.6 or later and test that script injection in API parameters is properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual POST/GET requests to /api/core/mod.rs with script-like parameters
- Multiple failed authentication attempts followed by successful login and API access
Network Indicators:
- HTTP requests containing <script> tags or JavaScript in URL parameters to the Vaultwarden API
SIEM Query:
source="vaultwarden" AND (url="/api/core/mod.rs" AND (param="<script>" OR param="javascript:"))