It took the developers of the popular password manager LastPass just a few hours to patch a critical vulnerability that could have been exploited to hack the application and gain access to users’ passwords.
The flaw, discovered by Google Project Zero researcher Tavis Ormandy, affected the LastPass add-on for Firefox. The expert noticed that a design flaw allowed a piece of JavaScript to click on the LastPass icon and interact with the application without the user’s knowledge.
According to Ormandy, an attacker could have exploited the vulnerability to completely compromise the add-on by tricking the victim into accessing a specially crafted website. The weakness could have allowed hackers to delete files, execute scripts, steal all passwords, and log into the targeted account in order to steal newly saved passwords.
LastPass released a patch for the vulnerability within hours after the Google researcher sent his report. The company noted that the flaw only affects the Firefox add-on. The fix has been pushed to users of LastPass 4.0 and later in version 4.1.21a.
In addition to Ormandy, security researcher Mathias Karlsson of Detectify disclosed on Wednesday a serious vulnerability that he reported to LastPass more than one year ago.
Karlsson found a flaw in the autofill functionality that allowed him to extract passwords for all commonly used websites simply by getting the victim to access a malicious site. The expert said LastPass patched the vulnerability within a day and awarded him a $1,000 bug bounty.
Last year, researchers Alberto Garcia Illera and Martin Vigo disclosed several flaws, bad practices and design issues that exposed the passwords of LastPass users to various types of attacks. The company also reported suffering a data breach last year, but said the attackers likely did not access any user accounts.
Ormandy has analyzed several security products over the past period and now he seems to have turned his attention to password managers. The expert has promised to analyze 1Password next.
This is not the first time the Google researcher has analyzed password managers. Earlier this year, he disclosed some serious vulnerabilities in a password manager shipped with various Trend Micro products.
Related: LastPass Notifies Users of OTP, Bookmarklet Vulnerabilities
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Intel Boasts Attack Surface Reduction With New 13th Gen Core vPro Platform
- Dole Says Employee Information Compromised in Ransomware Attack
- High-Severity Vulnerabilities Found in WellinTech Industrial Data Historian
- CISA Expands Cybersecurity Committee, Updates Baseline Security Goals
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
Latest News
- Microsoft: No-Interaction Outlook Zero Day Exploited Since Last April
- US to Adopt New Restrictions on Using Commercial Spyware
- Hackers Earn Over $1 Million at Pwn2Own Exploit Contest
- GoAnywhere Zero-Day Attack Hits Major Orgs
- Australia Dismantles BEC Group That Laundered $1.7 Million
- ‘Grim’ Criminal Abuse of ChatGPT is Coming, Europol Warns
- Webinar Tomorrow: Understanding Hidden Third-Party Identity Access Risks
- GitHub Rotates Publicly Exposed RSA SSH Private Key
