CVE-2024-56335

Executive Summary

CVE-2024-56335 is a critical authorization bypass vulnerability in Vaultwarden, an unofficial Bitwarden-compatible server written in Rust. The flaw allows an authenticated attacker with admin or owner permissions in one organization to update or delete groups in a different organization, provided they know the target organization's UUID and group UUID. This can lead to denial of service (by removing users from groups) or privilege escalation (if the attacker is also a member of the victim organization). The vulnerability only affects servers with the ORG_GROUPS_ENABLED setting enabled (disabled by default). The issue is patched in Vaultwarden version 1.32.7.

Supply Chain & Package Security

Vaultwarden is a Rust-based open-source project distributed via GitHub and Docker Hub. The vulnerability is not a supply chain attack but a logic flaw in the application's authorization checks. Users should verify the integrity of their Vaultwarden binaries or Docker images by checking checksums or signatures provided by the official repository.

CVSS Breakdown & Threat Level

• CVSS Score: 7.6 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs a valid user account with admin/owner rights in any organization.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N) – data is encrypted client-side.
• Integrity Impact: High (I:H) – groups can be modified or deleted.
• Availability Impact: High (A:H) – users can be removed from groups, causing denial of service.

Threat Level: High. The attack is easy to execute once the attacker has a valid account and knows the target UUIDs. The impact is significant for organizations relying on group-based access control.

Deep Dive & Mechanics

The vulnerability lies in the authorization logic for group management endpoints. When a user with admin or owner privileges in Organization A attempts to modify a group in Organization B, the server fails to properly validate that the user has the required permissions in Organization B. Instead, it only checks that the user has admin/owner rights in some organization.

Attack Flow:

1. Attacker creates an account on the target Vaultwarden server.
2. Attacker creates a new organization (or joins an existing one) and obtains admin or owner privileges.
3. Attacker obtains the UUID of the target organization and the target group (e.g., via information disclosure or brute-force).
4. Attacker sends a crafted API request to update or delete the target group.
5. The server processes the request because it only verifies that the user has admin/owner rights in any organization, not the specific one.

Root Cause: Missing or insufficient authorization checks in the group management endpoints. The code likely checks user.is_admin() or user.is_owner() without scoping the check to the target organization.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In group update handler
fn update_group(user: User, org_id: Uuid, group_id: Uuid, data: GroupData) -> Result<()> {
    if !user.is_admin() && !user.is_owner() {
        return Err(Error::Unauthorized);
    }
    // ... update group logic
}

Patched Code (Conceptual):

fn update_group(user: User, org_id: Uuid, group_id: Uuid, data: GroupData) -> Result<()> {
    // Check that user has admin/owner rights in the specific organization
    if !user.is_admin_of_org(org_id) && !user.is_owner_of_org(org_id) {
        return Err(Error::Unauthorized);
    }
    // ... update group logic
}

The patch adds a scope check to ensure the user's admin/owner privileges apply to the target organization, not just any organization.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Vaultwarden server with ORG_GROUPS_ENABLED=true.
• A user account with admin/owner privileges in at least one organization.
• Knowledge of the target organization's UUID and group UUID.

Exploitation Steps:

1. Enumerate UUIDs: If not known, attempt to discover organization and group UUIDs via API endpoints or by analyzing client-side code.
2. Craft Request: Use a tool like curl to send a malicious request.

# Example: Delete a group in a target organization
curl -X DELETE \
  "https://vaultwarden.example.com/api/organizations/{target_org_uuid}/groups/{target_group_uuid}" \
  -H "Authorization: Bearer {attacker_token}" \
  -H "Content-Type: application/json"

# Example: Update a group to add attacker to it
curl -X PUT \
  "https://vaultwarden.example.com/api/organizations/{target_org_uuid}/groups/{target_group_uuid}" \
  -H "Authorization: Bearer {attacker_token}" \
  -H "Content-Type: application/json" \
  -d '{"name":"UpdatedGroup","users":["attacker_user_uuid"]}'

3. Verify Impact: Check if the group was modified or deleted. If the attacker is a member of the target organization, they can now escalate privileges by joining restricted groups.

Blue Team

Detection:

• Monitor API logs for group modification/deletion requests from users who are not members of the target organization.
• Alert on multiple failed authorization attempts (401/403) followed by a successful group operation.
• Look for requests where the org_id in the URL does not match any organization the user belongs to.

Hunting:

• Query logs for DELETE or PUT requests to /api/organizations/*/groups/*.
• Correlate user IDs with organization memberships to detect anomalies.

Lab Setup:

• Deploy a vulnerable Vaultwarden instance (version < 1.32.7) in an isolated environment.
• Enable ORG_GROUPS_ENABLED=true.
• Create two organizations: one where the attacker has admin rights, and one victim organization.
• Simulate the attack and observe logs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • API requests to /api/organizations/{uuid}/groups/{uuid} from users not belonging to the target organization.
  • Repeated UUID enumeration attempts (e.g., scanning /api/organizations/ endpoints).
• Log IOCs:
  • Successful group modification/deletion by a user who is not a member of the organization.
  • INFO or WARN log entries showing group operations with unexpected user-org mismatches.
• System IOCs:
  • Unexpected changes to group memberships or group deletion.
  • Users gaining access to resources they should not have.

Detection Engineering

YARA Rule

rule CVE_2024_56335_Vaultwarden_Group_Bypass {
    meta:
        description = "Detects Vaultwarden group authorization bypass attempts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56335"
        hash = "unknown"
    strings:
        $s1 = "/api/organizations/" ascii wide nocase
        $s2 = "/groups/" ascii wide nocase
        $s3 = "DELETE" ascii wide nocase
        $s4 = "PUT" ascii wide nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: Vaultwarden Group Authorization Bypass (CVE-2024-56335)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-56335 by modifying groups in an organization the user does not belong to.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-56335
logsource:
    category: web
    product: vaultwarden
detection:
    selection:
        http.method: 
            - 'DELETE'
            - 'PUT'
        http.url|contains: '/api/organizations/'
        http.url|contains: '/groups/'
    filter:
        http.url|contains: '/api/organizations/{user_org_uuid}/'  # Replace with actual user org UUIDs
    condition: selection and not filter
falsepositives:
    - Legitimate group management by organization admins
level: high
tags:
    - attack.t1190
    - cve.2024.56335

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-56335 Vaultwarden Group Authorization Bypass Attempt";
    flow:to_server,established;
    content:"/api/organizations/"; http_uri;
    content:"/groups/"; http_uri;
    http_method; content:"DELETE"; or;
    http_method; content:"PUT";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2024-56335;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Vaultwarden to version 1.32.7 or later.
2. Disable Groups: If upgrade is not possible, set ORG_GROUPS_ENABLED=false to disable group functionality.
3. Disable Signups: Set SIGNUPS_ALLOWED=false to prevent attackers from creating new accounts.

Long-term Measures:

• Implement strict authorization checks for all API endpoints.
• Conduct regular security audits of the codebase.
• Monitor for unusual API activity, especially group management operations.

Workarounds:

• Use a Web Application Firewall (WAF) to block requests to /api/organizations/*/groups/* from users not belonging to the target organization (requires dynamic user-org mapping).
• Restrict API access to trusted IPs only.

Valters IT
Securing Digital Frontiers