Re:Leaking Bitwarden's Vault with a Nginx vulnerability
by whiskeymikey on Monday July 03, 2023 @09:13PM
(#36580909)
This is probably a dumb question but why would Bitwarden allow unauthenticated requests to /attachments at all? Even with the Nginx bug, wouldn’t the request have failed if that URL required authentication?
[ Parent
| on HN ]
Re:Leaking Bitwarden's Vault with a Nginx vulnerability
by Someone1234 on Monday July 03, 2023 @10:20PM
(#36581417)
This is an exploit against the web server's configuration, so never executes Bitwarden's authentication code or any Bitwarden code at all. It isn't unusual or incorrect for projects to use their own authentication rather than Nginx or a module.
It is still Bitwarden's responsibility since they shipped a dangerous configuration via Docker. Which they seemingly acknowledge and have since fixed.
Re:Leaking Bitwarden's Vault with a Nginx vulnerability
by autoexec on Tuesday July 04, 2023 @12:57AM
(#36582403)
> It is still Bitwarden's responsibility since they shipped a dangerous configuration via Docker. Which they seemingly acknowledge and have since fixed.
The screenshot makes it look like the docker setup option was still in beta and the page had warnings all over it saying there could be possible issues. I can't really judge Bitwarden too harshly here for releasing something in beta that was later found to have a vulnerability in it.