1212224 – (CVE-2023-27706) VUL-0: CVE-2023-27706: bitwarden: Biometric key is stored in Windows Credential Manager, accessible to other local unprivileged processes

Bug 1212224 (CVE-2023-27706) - VUL-0: CVE-2023-27706: bitwarden: Biometric key is stored in Windows Credential Manager, accessible to other local unprivileged processes

Summary: VUL-0: CVE-2023-27706: bitwarden: Biometric key is stored in Windows Credenti...

Status:	RESOLVED INVALID

Alias:	CVE-2023-27706

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other Other

Priority:	P5 - None Severity: Normal
Target Milestone:	---
Assignee:	Bruno Pitrus
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/369004/
Whiteboard:
Keywords:

Depends on:
Blocks:

Clone This Bug

Reported:	2023-06-12 09:32 UTC by Thomas Leroy
Modified:	2023-06-12 09:32 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Thomas Leroy 2023-06-12 09:32:17 UTC

CVE-2023-27706

Bitwarden Desktop v1.20.0 and above stores the biometric key in plaintext which
allows a local attacker to decrypt the entire local vault.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-27706
https://www.cve.org/CVERecord?id=CVE-2023-27706
https://github.com/bitwarden/clients
https://github.com/bitwarden/clients/blob/8b5a223ad4ca0f89b6c9bcdbddef464d1755d2c0/apps/desktop/desktop_native/src/password/windows.rs#L16
https://hackerone.com/reports/1874155

Comment 1 Thomas Leroy 2023-06-12 09:32:56 UTC

Windows only, closing