Active Directory Integrated Login Vulnerability
A critical flaw was discovered in Passwordstate where an attacker, using only a victim’s Active Directory username, could bypass authentication and gain full access to the victim's account. This includes all credentials the victim can access and any administrative privileges.
Conditions for the attack to succeed:
- The victim’s account must exist in the Passwordstate system.
- Active Directory integrated login must be enabled.
- The attacker must know the victim’s AD username.
The login pages at either /logins/loginadan.aspx or /logins/loginad.aspx must be accessible.
Attack flow:
- The attacker visits the login page and submits the victim’s AD username with an incorrect password.
- Despite the failed login, the attacker can directly navigate to the multi-factor authentication (MFA) setup page (e.g., /logins/creategoogletfsecretkey.aspx) and configure MFA.
This setup initiates a partial session, which is mistakenly treated as valid.
As a result, the attacker is granted access to the victim’s account without needing the correct password.
This vulnerability also applies to alternative MFA setup endpoints such as one-time password and ScramblePad authentication, and can act as a method of MFA bypass when using stolen credentials.
Proof of concept
A proof-of-concept video titled "Passwordstate account takeover vulnerability PoC (CVE-2024-39337)" is available on YouTube. For more information, see the vendor’s advisory page.
SAML Authentication Bypass
In environments where Active Directory login uses SAML authentication, the exploit is typically blocked due to redirection to an SSO login page. However, by first visiting the /emergency/ page, the attacker can bypass this restriction and return to the AD login page to execute the attack.
Local Account Login Vulnerability
A similar attack was also found to affect local account logins. If the attacker has the victim’s local login username and access to one of the login pages, they can:
Attempt to log in with an arbitrary password (which fails).
Visit the password reset page (/logins/resetpassword.aspx) where the victim's reset form appears.
Complete the reset and log in using the new password, gaining full access to the account.
Another proof-of-concept video titled "Passwordstate account password reset PoC (CVE-2024-39337)" demonstrates this vulnerability on YouTube.
Remediation
The vulnerability is resolved in Build 9858 of Passwordstate. Users are strongly advised to upgrade to this version as soon as possible.
Disclosure Timeline
- 04/03/2024 – Vulnerability reported to Click Studios.
- 07/03/2024 – Patch released in Build 9858.
- 24/06/2024 – CVE-2024-39337 assigned.
- 25/06/2024 – Blog published.
