The password manager bitwarden requires the user to log in to their account on their web site to allow them to enable 2FA, import passwords and manage other account related details, as that functionality is not available on the desktop or mobile applications. Could a supposed attacker that has gained control of a self hosted instance inject malicious JavaScript code into the web page front end to steal the user's password? What are the options for an attacker to steal the keys to the password database when the user uses the web vault? Could such an attack be avoided by using an application that does not pull logic from the server?
1 Answer
If someone gained access to a self-hosted instance, that would certainly be possible. But if an attacker were able to get the user's passwords, they would need to send them to a remote server or login back into the instance to get the data.
With a self-hosted instance, I would be more concerned with how data is transferred between the server and the client. Do you have a valid SSL certificate installed with strong encryption parameters? Using a self-signed one isn't safe and poses a larger risk than a malicious Javascaript file because it would be harder to detect a network sniffer rather than hack into a server. You could also be susceptible to a man-in-the-middle attack where an attacker forwards you to a server under their control where they can intercept the network traffic and decrypt the data.
https://www.computerworld.com/article/2569788/sniffing-out-network-sniffers.html
https://www.thesslstore.com/blog/risks-of-using-self-signed-certificates/
What are the risks of self signing a certificate for SSL
https://www.rapid7.com/fundamentals/man-in-the-middle-attacks/
Either way, once an attacker has that level of access to a system where they can manipulate the software like that, they'll probably be able to access the passwords in multiple different ways. The best way to prevent unauthorized access to a self-hosted password manager like the one you're describing is to limit who has access to the server.
- It shouldn't be publicly accessible on the internet
- A firewall should be installed which blocks all ports except the one that is required to be open
- A network firewall rule should also block all ports except the required ones and also grant access to computers that need access.
- Is Javascript needed in the Bitwarden admin interface? You could install an extension called "No Script" which blocks javascript files from loading on certain websites.
LastPass has a setting that you have to enable where it requires you to enter your password every time before viewing a password in the password manager.
