Bitwarden's autofill feature poses a serious security risk, as malicious iframes placed on trusted websites can access the user's credentials and send them to an attacker .
See also: Google ads phishing attack targets Bitwarden users
Flashpoint analysts brought the issue to light, noting that Bitwarden had identified the problem since 2018, but decided to keep it due to the potential beneficial use of iframes on legitimate websites.
Although the autofill feature is disabled in Bitwarden by default and there are few circumstances suitable for exploitation, Flashpoint claims that some websites still meet these requirements. Consequently, malicious attackers can try to exploit this vulnerability.
Bitwarden is a highly sought-after open-source password manager service with a built-in web browser extension that securely stores confidential data, including usernames and account passwords, in its encrypted vault.
Whenever its users visit a website, the extension has the ability to detect if there is a saved account login for that domain and accordingly, automatically provides the credentials. Once the autofill option is enabled, pages load quickly and effortlessly with information already filled in for users – no extra effort required!
After researching Bitwarden's features, Flashpoint researchers made a stunning revelation: The browser extension automatically fills not only standard forms but also those embedded in iframes from external domains.
Through its research, Flashpoint discovered that the use of iframes on high-traffic websites was a rare occurrence. Consequently, this drastically reduced the potential risks associated with these activities.
See also: The best free media player apps for Windows
Flashpoint also discovered another issue during its investigation of the iframe topic – Bitwarden can automatically fill login credentials for any of the subdomains of the main domain!
If an attacker is able to create a phishing that matches the saved login of a specific key domain, they will be able to successfully capture any credentials entered when autofill is enabled by unsuspecting victims.
It may not be feasible to register a subdomain that is identical to the primary domain of a legitimate website, thereby reducing the severity of this issue.
However, some platforms allow users to create subdomains for the purpose of hosting material, such as free hosting services. It is worrying that subdomain piracy is still possible even with these services.
Bitwarden emphasizes that the autofill feature is a potential security threat and even includes an explicit warning in documentation , specifically emphasizing how vulnerable it makes you to websites that abuse the feature to steal credentials.
Ο κίνδυνος ασφαλείας αποκαλύφθηκε για πρώτη φορά τον Νοέμβριο του 2018, και η Bitwarden τον γνωρίζει από τότε.
Παρά τις συνέπειες για την ασφάλεια που έχει η ανάγκη σύνδεσης των χρηστών σε υπηρεσίες με ενσωματωμένα iframes από εξωτερικούς τομείς, οι μηχανικοί της Bitwarden επέλεξαν να διατηρήσουν αυτή τη συμπεριφορά και να δημοσιεύσουν μια προειδοποίηση τόσο στην τεκμηρίωση του λογισμικού τους όσο και στο σχετικό μενού ρυθμίσεων.
See also: Telegram v9.4: Translation of entire conversations and other new features
Overall, iframes are a powerful tool for both developers and marketers. They allow external information, such as images and videos, to be embedded into pages without disrupting existing designs or layouts. They also allow users to navigate between different websites while remaining on the same page, making it easier than ever to find relevant information quickly and easily without having to leave the site entirely.
