Vulnerability · Published Jan 27, 2025 · Assigned by GitHub_M

CVE-2025-24364vaultwarden allows RCE in the admin panel

High 7.2

In plain English

A high-severity injection in vaultwarden from dani-garcia. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)1.0%top 37.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker with authenticated access to the vaultwarden admin panel can execute arbitrary code in the system. The attacker could then change some settings to use sendmail as mail agent but adjust the settings in such a way that it would use a shell command. It then also needed to craft a special favicon image which would have the commands embedded to run during for example sending a test email. This vulnerability is fixed in 1.33.0.

Affected products (as reported)

Vendor	Product	Versions
dani-garcia	vaultwarden	< 1.33.0

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h6cc-rc6q-23j4 x_refsource_CONFIRM
https://github.com/dani-garcia/vaultwarden/releases/tag/1.33.0 x_refsource_MISC