1Password, one of the best password managers on the market, has urged Mac users to download a patch for its login credentials storage after a bug was discovered that could allow attackers to crack vaults.
1Password allows users to create password vaults within the app, allowing them to separate their login credentials between work and personal, for example.
But this vulnerability, which is tracked as CVE-2024-42219 with a CVSS of 7.0, can be abused by attackers to steal entire password vaults from macOS users running 1Password version 8.10.36.
Cracking the safe
The flaw was discovered by security teams at Robinhood, who decided to test the 1Password app for vulnerabilities. The National Vulnerability Database specifically describes the flaw as allowing “local attackers to exfiltrate vault items because XPC inter-process communication validation is insufficient.”
In a advisoryThe company stated, “To exploit the issue, an attacker would need to run malicious software on a computer that specifically targets 1Password for Mac. An attacker could abuse missing macOS-specific inter-process validations to hijack or impersonate a trusted 1Password integration, such as the 1Password browser extension or CLI.”
“This would allow the malicious software to exfiltrate vault items and obtain derived values used to log in to 1Password, specifically the account unlock key and “SRP-𝑥”.”
The only way to exploit this vulnerability is to trick the user into installing a special program on the target computer. However, there is no evidence so far that this has actually happened.
1Password states that approximately 150,000 businesses rely on 1Password to store important credentials, but it is unclear how many of these use macOS devices. Windows users are not affected by this vulnerability.