starred/vaultwarden
1
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2025-12-09 09:13:02 +03:00
Code Issues 429 Packages Projects Releases 10 Wiki Activity

"PII Disclosure" issue impact our root domain being marked as Deceptive Content #830

New Issue
Closed
opened 2025-10-09 16:53:14 +03:00 by OVERLORD · 1 comment
OVERLORD commented 2025-10-09 16:53:14 +03:00
Owner
Copy Link

Originally created by @saggafarsyad on GitHub.

Subject of the issue

In url <BASE_URL>/app/main.3a27378a743dd4ad9f70.js contains Credit Card Number "4242424242424242" which contains Personally Identifiable Information, such as CC number, SSN and similar sensitive data.

We suspect that this alert is a false alarm because the hardcoded text is intended as example or placeholder. But this PII Disclosure issue impact our root domain being marked as Deceptive content by Google and all our websites within subdomain were marked as Dangerous.

Solution

We tried replace "4242424242424242" to "42424242xxxxxxxx" on compiled file /web-vault/app/main.3a27378a743dd4ad9f70.js, re-deploy and re-scan OWASP ZAP, then the issue is resolved.

Deployment environment

  • vaultwarden version: 1.28.1

  • Install method: Docker image

  • Clients used: Web Vault, Chrome Extensions

  • Reverse proxy and version: NGINX v1.24.0

  • MySQL/MariaDB or PostgreSQL version: N/A

  • Other relevant details: Web Vault Version 2023.3.0

Steps to reproduce

  • Scan with OWASP ZAP

Expected behaviour

  • No High Risk Alerts

Actual behaviour

  • OWASP ZAP catch dummy Credit Card Number "4242424242424242" as PII Disclosure issue and marked as High Risk alert by OWASP ZAP scanner

Troubleshooting data

Originally created by @saggafarsyad on GitHub. <!-- # ### NOTE: Please update to the latest version of vaultwarden before reporting an issue! This saves you and us a lot of time and troubleshooting. See: * https://github.com/dani-garcia/vaultwarden/issues/1180 * https://github.com/dani-garcia/vaultwarden/wiki/Updating-the-vaultwarden-image # ### --> <!-- Please fill out the following template to make solving your problem easier and faster for us. This is only a guideline. If you think that parts are unnecessary for your issue, feel free to remove them. Remember to hide/redact personal or confidential information, such as passwords, IP addresses, and DNS names as appropriate. --> ### Subject of the issue In url <BASE_URL>/app/main.3a27378a743dd4ad9f70.js contains Credit Card Number "4242424242424242" which contains Personally Identifiable Information, such as CC number, SSN and similar sensitive data. We suspect that this alert is a false alarm because the hardcoded text is intended as example or placeholder. But this PII Disclosure issue impact our root domain being marked as Deceptive content by Google and all our websites within subdomain were marked as Dangerous. #### Solution We tried replace "4242424242424242" to "42424242xxxxxxxx" on compiled file `/web-vault/app/main.3a27378a743dd4ad9f70.js`, re-deploy and re-scan OWASP ZAP, then the issue is resolved. ### Deployment environment <!-- ========================================================================================= Preferably, use the `Generate Support String` button on the admin page's Diagnostics tab. That will auto-generate most of the info requested in this section. ========================================================================================= --> <!-- The version number, obtained from the logs (at startup) or the admin diagnostics page --> <!-- This is NOT the version number shown on the web vault, which is versioned separately from vaultwarden --> <!-- Remember to check if your issue exists on the latest version first! --> * vaultwarden version: 1.28.1 <!-- How the server was installed: Docker image, OS package, built from source, etc. --> * Install method: Docker image * Clients used: Web Vault, Chrome Extensions <!-- web vault, desktop, Android, iOS, etc. (if applicable) --> * Reverse proxy and version: NGINX v1.24.0 <!-- if applicable --> * MySQL/MariaDB or PostgreSQL version: N/A <!-- if applicable --> * Other relevant details: Web Vault Version 2023.3.0 ### Steps to reproduce * Scan with OWASP ZAP ### Expected behaviour <!-- Tell us what you expected to happen --> * No High Risk Alerts ### Actual behaviour <!-- Tell us what actually happened --> * OWASP ZAP catch dummy Credit Card Number "4242424242424242" as PII Disclosure issue and marked as High Risk alert by OWASP ZAP scanner ### Troubleshooting data <!-- Share any log files, screenshots, or other relevant troubleshooting data --> * Related code <img width="1644" alt="Screenshot 2023-05-02 at 11 42 43" src="https://user-images.githubusercontent.com/7218502/235574801-95494019-b219-4497-b883-79be9f8aae3f.png"> * Related CWE: https://cwe.mitre.org/data/definitions/359.html * OWASP ZAP Plugin: https://www.zaproxy.org/docs/alerts/10062/
OVERLORD commented 2025-10-09 16:53:17 +03:00
Author
Owner
Copy Link

@BlackDex commented on GitHub:

This is not something we can fix for one. This code is part of the Bitwarden Clients repo https://github.com/search?q=repo%3Abitwarden%2Fclients%2042424242&type=code .

Second, that is a known test credit-card number. So i suggest to create a ticket at the detection library and report to let it exclude this and maybe other well knows test numbers.

@BlackDex commented on GitHub: This is not something we can fix for one. This code is part of the Bitwarden Clients repo https://github.com/search?q=repo%3Abitwarden%2Fclients%2042424242&type=code . Second, that is a known test credit-card number. So i suggest to create a ticket at the detection library and report to let it exclude this and maybe other well knows test numbers.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
better for forum
bug
bug
bug
documentation
duplicate
enhancement
future Vault
good first issue
help wanted
low priority
notes
pull-request
Mirrored from GitHub Pull Request
 question
SSO
Third party
troubleshooting
troubleshooting
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/vaultwarden#830
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?