# Bitwarden autofill & iFrame (minor) issue **URL:** \ **Category:** Software\ **Created:** [March 9, 2023, 7:22am UTC](https://www.twit.community/t/bitwarden-autofill-iframe-minor-issue/14277 "2023-03-09T07:22:46Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![big\_D](https://sea2.discourse-cdn.com/flex020/user_avatar/www.twit.community/big_d/32/1023_2.png) [@big\_D](https://www.twit.community/u/big_D)\ **Post date:** [March 9, 2023, 7:22am UTC](https://www.twit.community/t/bitwarden-autofill-iframe-minor-issue/14277/1 "2023-03-09T07:22:46Z")
Bleeping Computer is reporting on a weakness in BitWarden that could allow it to be fooled by iFrames in trusted websites hijacking usernames and passwords, _if autofill is enabled_. Allegedly, Bitwarden has known about the issue since 2018 _(it is also mentioned in their documentation)_, but has deemed it too useful for legitimate websites that _do_ use iFrames to disable it. The problem is, if someone slips an iFrame into a site that is trusted, they can hijack the autofill data. > Although the auto-fill feature is disabled on Bitwarden by default, and the conditions to exploit it aren’t abundant, Flashpoint says there are still websites that meet the requirements where motivated threat actors can attempt to exploit these flaws. The problem seems to be that autofill automatically fills in username and passwords on known sites, if enabled. Flashpoint discovered that if there is an iFrame from a bad actor embedded into the website with the same username and password fields, Bitwarden will automatically fill in the username and password both on the main form and in the iFrame’s form. There are sites that are designed this way, although they are, thankfully, relatively rare. But during the investigation, Flashpoint found out that a malicious form on a sub-domained iFrame could capture the credentials. The “saving grace” for Bitwarden is that it will only fill in the iFrame information, if it belongs to a sub-domain of the original TLD. E.g. if the login information is for “[login.mycorp.net](http://login.mycorp.net)”, Bitwarden will also automatically fill in the details on “[badboy.mycorp.net](http://badboy.mycorp.net)”, _**but it wouldn’t fill them in for “[login.badactor.net](http://login.badactor.net)”**_. This makes it much harder to exploit, but not impossible - some hosting services allow users to register sub-domains. > This risk was first brought to light in a [security assessment](https://cdn.bitwarden.net/misc/Bitwarden%20Security%20Assessment%20Report.pdf) dated November 2018, so Bitwarden has been aware of the security problem for some time now. > However, since users need to log in to services using embedded iframes from external domains, Bitwarden’s engineers decided to keep the behavior unchanged and add a warning on the software’s documentation and the extension’s relevant settings menu. **This is a problem, but it isn’t a massive problem. The attacker has to have already managed to register/take over a valid sub-domain of the original domain in order for the attack to work.** > “Some content hosting providers allow hosting arbitrary content under a subdomain of their official domain, which also serves their login page,” explains Flashpoint in the report. > “As an example, should a company have a login page at [https://logins.company.tld](https://logins.company.tld) and allow users to serve content under https://_clientname_.company.tld, these users are able to steal credentials from the Bitwarden extensions.” **The issue is already well documented and Bitwarden does display a prominent warning, if users try and turn on the feature. If the feature is disabled and you just let Bitwarden enter the credentials in the visible form field, when you are actually logging in, the iFrame cannot grab the credentials.** This looks like a minor issue and the default configuration of Bitwarden would block this behaviour. If you have autofill enabled, you might want to think twice and disable it. _But this is in no way an issue where you need to abandon Bitwarden or shy away from password managers in general._ Bitwarden have said they will block the reported bad sub-domains in an upcoming release, but they will not disable the iFrame feature at this time. **So, if autofill is not essential to your workflow, turn it off and use the extra click to manually get Bitwarden to fill in the username and password in the correct fields.** > **[Bitwarden flaw can let hackers steal passwords using iframes](https://www.bleepingcomputer.com/news/security/bitwarden-flaw-can-let-hackers-steal-passwords-using-iframes/)** > > Bitwarden's credentials autofill feature contains a risky behavior that could allow malicious iframes embedded in trusted websites to steal people's credentials and send them to an attacker. ---
**Author:** ![Slickster](https://avatars.discourse-cdn.com/v4/letter/s/46a35a/32.png) [@Slickster](https://www.twit.community/u/Slickster)\ **Post date:** [March 12, 2023, 12:49pm UTC](https://www.twit.community/t/bitwarden-autofill-iframe-minor-issue/14277/2 "2023-03-12T12:49:01Z")
Somewhat dissapointed that this flaw has not been fixed in 4 years. If it is so minor, why wouldnt they take care of it? ---
**Author:** ![big\_D](https://sea2.discourse-cdn.com/flex020/user_avatar/www.twit.community/big_d/32/1023_2.png) [@big\_D](https://www.twit.community/u/big_D)\ **Post date:** [March 12, 2023, 1:59pm UTC](https://www.twit.community/t/bitwarden-autofill-iframe-minor-issue/14277/3 "2023-03-12T13:59:22Z")
Because it is used by genuine sites, but can be abused. They decided to leave the feature in the product and warn users instead- it has been documented as a possible weakness since 2018 and there is a warning in the tool itself, if you try and enable it. ---
**Author:** ![Leo](https://sea2.discourse-cdn.com/flex020/user_avatar/www.twit.community/leo/32/16203_2.png) [@Leo](https://www.twit.community/u/Leo)\ **Post date:** [March 12, 2023, 4:06pm UTC](https://www.twit.community/t/bitwarden-autofill-iframe-minor-issue/14277/4 "2023-03-12T16:06:12Z")
This is one of the things Tavis Ormandy of Google was complaining about with _all_ browser extension auto-fill in password managers. I don’t know if it affects other PMs but I bet it does. Ormandy’s recommendation was to use the browser’s native password manager. Mine is to turn off auto-fill or better yet – if this flaw worries you — not use the browser extension at all. Browser extensions are fraught with peril. Better to cut and paste from the password manager’s app. ---
**Author:** ![CrimsonChin](https://sea2.discourse-cdn.com/flex020/user_avatar/www.twit.community/crimsonchin/32/2316_2.png) [@CrimsonChin](https://www.twit.community/u/CrimsonChin)\ **Post date:** [March 17, 2023, 3:10pm UTC](https://www.twit.community/t/bitwarden-autofill-iframe-minor-issue/14277/5 "2023-03-17T15:10:23Z")
Ghacks website reports that Bitwarden is rolling out a fix for this issue. " Bitwarden created a fix for the issue that is [documented](https://github.com/bitwarden/clients/pull/4994) on the company’s official GitHub website. Bitwarden engineers addressed the issue by changing how autofill on page load works. It will still fill out login data automatically, but only on trusted domains. When users fill out data manually, they do get a warning prompt if the iframe is untrusted." > **[Bitwarden addresses autofill issue that could be exploited to steal logins -...](https://www.ghacks.net/2023/03/17/bitwarden-addresses-autofill-issue-that-could-be-exploited-to-steal-logins/)** > > Bitwarden plans to roll out an update that addresses an autofill issue that threat actors could exploit to steal login information. ---
**Author:** ![big\_D](https://sea2.discourse-cdn.com/flex020/user_avatar/www.twit.community/big_d/32/1023_2.png) [@big\_D](https://www.twit.community/u/big_D)\ **Post date:** [March 17, 2023, 3:11pm UTC](https://www.twit.community/t/bitwarden-autofill-iframe-minor-issue/14277/6 "2023-03-17T15:11:40Z")
Yes, this was reported in the original article I linked to. They wanted to allow legitimate sites (white listing) and sites the user had used before, whilst blocking all others.