It took the developers of the popular password manager LastPass just a few hours to patch a critical vulnerability that could have been exploited to hack the application and gain access to users’ passwords.
The flaw, discovered by Google Project Zero researcher Tavis Ormandy, affected the LastPass add-on for Firefox. The expert noticed that a design flaw allowed a piece of JavaScript to click on the LastPass icon and interact with the application without the user’s knowledge.
According to Ormandy, an attacker could have exploited the vulnerability to completely compromise the add-on by tricking the victim into accessing a specially crafted website. The weakness could have allowed hackers to delete files, execute scripts, steal all passwords, and log into the targeted account in order to steal newly saved passwords.
LastPass released a patch for the vulnerability within hours after the Google researcher sent his report. The company noted that the flaw only affects the Firefox add-on. The fix has been pushed to users of LastPass 4.0 and later in version 4.1.21a.
In addition to Ormandy, security researcher Mathias Karlsson of Detectify disclosed on Wednesday a serious vulnerability that he reported to LastPass more than one year ago.
Karlsson found a flaw in the autofill functionality that allowed him to extract passwords for all commonly used websites simply by getting the victim to access a malicious site. The expert said LastPass patched the vulnerability within a day and awarded him a $1,000 bug bounty.
Last year, researchers Alberto Garcia Illera and Martin Vigo disclosed several flaws, bad practices and design issues that exposed the passwords of LastPass users to various types of attacks. The company also reported suffering a data breach last year, but said the attackers likely did not access any user accounts.
Ormandy has analyzed several security products over the past period and now he seems to have turned his attention to password managers. The expert has promised to analyze 1Password next.
This is not the first time the Google researcher has analyzed password managers. Earlier this year, he disclosed some serious vulnerabilities in a password manager shipped with various Trend Micro products.
Related: LastPass Notifies Users of OTP, Bookmarklet Vulnerabilities