CVE-2025-24365

Executive Summary

CVE-2025-24365 is a critical privilege escalation vulnerability in Vaultwarden, an unofficial Bitwarden-compatible server written in Rust. An authenticated attacker who is an owner or admin of one organization can exploit this flaw to gain owner rights over another organization, provided they know the victim organization's ID. This allows the attacker to exfiltrate all secrets, modify policies, and delete the organization. The vulnerability is fixed in version 1.33.0. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

Vaultwarden is distributed as a Docker image and via GitHub releases. Users should verify the integrity of their deployment by checking the SHA256 checksums provided in the release notes. The project is not available via NPM, PyPI, Go, or Ruby registries.

CVSS Breakdown & Threat Level

CVSS Score: 8.1 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

• Attack Vector (AV): Network – The attacker can exploit this remotely.
• Attack Complexity (AC): Low – No special conditions required beyond knowing the victim organization ID.
• Privileges Required (PR): Low – The attacker must be an authenticated user with owner/admin rights in at least one organization.
• User Interaction (UI): None – No victim interaction needed.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full access to all secrets in the victim organization.
• Integrity (I): High – Ability to modify organization policies and data.
• Availability (A): None – No direct impact on availability.

Deep Dive & Mechanics

The vulnerability resides in the organization ownership transfer logic. In Vaultwarden, an organization owner can transfer ownership to another user. The flaw occurs because the server does not properly validate that the requesting user is the current owner of the target organization. Instead, it only checks that the user has owner/admin privileges in some organization.

Attack Flow:

1. Attacker creates or joins Organization A as an owner/admin.
2. Attacker obtains the Organization ID of the target Organization B (e.g., via information disclosure, shared membership, or brute-force).
3. Attacker sends a crafted API request to transfer ownership of Organization B to themselves.
4. The server incorrectly validates the attacker's ownership of Organization A and applies it to Organization B.
5. Attacker gains full owner rights over Organization B.

The root cause is a missing or incorrect check on the organization_id parameter in the ownership transfer endpoint. The code likely compares the user's role against a hardcoded or session-based organization ID instead of the one provided in the request.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Only checks if user is owner/admin in any org
fn transfer_ownership(user_id, target_org_id, new_owner_id) {
    let user_orgs = get_user_organizations(user_id);
    if user_orgs.iter().any(|org| org.role == "Owner" || org.role == "Admin") {
        // Proceed with transfer - BUG: doesn't verify target_org_id matches user's org
        execute_transfer(target_org_id, new_owner_id);
    }
}

Patched Code (Conceptual):

// Patched: Verifies user is owner of the specific target organization
fn transfer_ownership(user_id, target_org_id, new_owner_id) {
    let user_org = get_user_organization(user_id, target_org_id);
    if user_org.role == "Owner" {
        execute_transfer(target_org_id, new_owner_id);
    } else {
        return Err("Not authorized");
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Vaultwarden instance (version < 1.33.0)
• Valid credentials for an account that is owner/admin of at least one organization
• Knowledge of the target organization ID (e.g., org_b_id)

Exploitation Steps:

1. Authenticate and obtain a session token.
2. Identify the target organization ID (e.g., via API enumeration or shared membership).
3. Send a POST request to /api/organizations/{org_b_id}/transfer-ownership with the new owner's user ID.

Example cURL Command:

curl -X POST "https://vaultwarden.example.com/api/organizations/ORG_B_ID/transfer-ownership" \
  -H "Authorization: Bearer YOUR_SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"userId": "NEW_OWNER_USER_ID"}'

Expected Outcome: The attacker's account (or the specified new owner) gains owner rights over Organization B.

Blue Team

Detection:

• Monitor API logs for unexpected ownership transfer requests, especially from users who are not the current owner of the target organization.
• Alert on multiple failed transfer attempts to different organization IDs from the same user.
• Review organization membership changes for unauthorized promotions.

Hunting Query (Splunk):

index=vaultwarden_logs source="/var/log/vaultwarden.log"
| rex "Transfer ownership request for org (?<org_id>\S+) from user (?<user_id>\S+)"
| stats count by org_id, user_id
| where count > 1

Indicators of Compromise (IOCs)

• Network: Unusual API calls to /api/organizations/*/transfer-ownership from non-owner users.
• Logs: Log entries showing transfer_ownership action with unexpected user-org combinations.
• System: Sudden changes in organization ownership or unexpected admin accounts.
• File: No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2025_24365_Vaultwarden_PrivEsc {
    meta:
        description = "Detects exploitation attempts of CVE-2025-24365 in Vaultwarden logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-24365"
    strings:
        $s1 = "transfer-ownership" ascii nocase
        $s2 = "organization" ascii nocase
        $s3 = "owner" ascii nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-24365 - Vaultwarden Organization Ownership Transfer Abuse
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized organization ownership transfer attempts in Vaultwarden
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: vaultwarden
detection:
    selection:
        EventID: 1001
        Action: "transfer_ownership"
        UserRole: "Member"
    condition: selection
falsepositives:
    - Legitimate transfers by authorized owners
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-24365 - Vaultwarden Organization Ownership Transfer Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/organizations/"; http_uri; content:"/transfer-ownership"; http_uri; pcre:"/\/api\/organizations\/[a-f0-9]+\/transfer-ownership/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Vaultwarden to version 1.33.0 or later.
2. If immediate upgrade is not possible, restrict API access to trusted IPs and monitor for suspicious transfer requests.

Long-term:

• Implement strict role-based access control (RBAC) validation on all organization-level operations.
• Conduct regular security audits of API endpoints handling sensitive actions.
• Enable detailed audit logging and integrate with SIEM for real-time alerting.

Workaround:

• Disable organization creation for non-admin users if feasible.
• Manually review all organization ownership changes until patched.

Valters IT