Unwise design choices from a specialty password manager allowed any malicious website to obtain complete, persistent access to customers’ vaults.
“Passportal” is a credential management product from N-able, formerly SolarWinds MSP, a now-independent and nearly billion-dollar public company. N-able markets its products primarily to managed service providers (MSPs) and IT services providers, and according to its website, Passportal is used by around 2,500 managed service providers (MSPs) and 165,000 small and medium-sized businesses (SMBs).
Those organizations should be wary, though, because since their password manager operates over the cloud, their ultra-sensitive secrets are potentially vulnerable to Web-based exploits. On July 8, Bay Area Labs founder James Arnott discovered that Passportal accounts — and all of the credentials they manage — can be completely compromised by any website the user visits. The vendor implemented a patch the next day, but even the updated product carries some risk for users, Arnott tells Dark Reading.
Security Vulnerabilities in N-able Passportal
Most mainstream password managers perform their most sensitive functions on a local machine to reduce the risk that Web-based attackers can get to passwords. It’s fairly simple: The master password generates a secret key that decrypts the otherwise scrambled, stored passwords, and that key stays with the user at all times. Any website a person logs in to only sees the product of the decryption process — i.e., plaintext passwords.
Passportal does things differently. Its master passwords generate access and refresh tokens, the former of which carries the secret key. When an employee wants to log in to a website, the access token travels to N-able’s servers, N-able uses it to unscramble the login information into plaintext, and then it sends the password back to the user (with TLS encryption during transit) so the person can log in. But what if a hacker somehow inserts themselves into this process and nabs the access token for themselves?
That turned out not to be so difficult. Bay Area Labs found that Passportal’s browser extension was entirely undiscerning — it trusted every message it received, without bothering to check what website sent it and what its contents were. Thus, if an employee could be lured to visit a malicious website — or a legitimate one with a malicious ad or iframe injected — Passportal would unquestionably listen to whatever it had to say. If it said window.postMessage({ method: ‘getPasswords’ }, ‘*’), Passportal would unthinkingly reply with the access and refresh tokens.
With an access token, an attacker could enumerate and steal every single account credential in a Passportal vault. They could also obtain time-based, one-time passwords (TOTPs) as necessary to access all of an organization’s most sensitive accounts.
The stolen refresh token is useful, too — it allows an attacker to obtain a new access token as soon as an existing one expires. Access tokens expire pretty quickly (it’s why users have to reenter master passwords so often to log in to their password managers), but the Passportal refresh token lasts for 100 days.
Total, persistent password vault compromise is nothing to sniff at, but on top of that, one has to consider that Passportal is typically used by supply chain services providers. “Say, for example, an attacker could get access to one MSP that manages 50 organizations. That MSP would very likely have highly privileged access to all of their downstream clients,” Arnott tells Dark Reading.
The risk expands significantly further when Passportal customers utilize its “branded password management as a service” (PMaaS) feature, “Site.” Site allows service providers to rebrand Passportal using their own brand iconography and then redistribute it downstream to their own clients. If a hacker steals the secret key for a Passportal customer, which itself sells Passportal to more customers, it stands to reason that those twice-removed customers would also be compromised, though Arnott didn’t test this scenario in practice.
Should Credential Managers Ever Be Cloud-Based?
Mere hours after Arnott confirmed his findings, N-able deployed a patch: a simple fix consisting of a check that makes sure the browser extension is the origin of requests, not random websites or iframes.
Browser extensions like Passportal typically update automatically, outside of view and, frankly, outside of notice for most organizations. To ensure that no workstation in an organization falls behind, though, Arnott suggests that proactive administrators can perform version locking. “In the Google Workspace admin console, you can lock extensions in specific versions, and then they’ll all update once you bump the version manually from the admin console,” he explains.
Even updating across the board doesn’t mean that customers are out of the woods, though. Passportal continues to perform server-side decryption. Because the patch did not implement end-to-end encryption (E2EE), Arnott says, user passwords can still be at risk.
“In my opinion, there is no good reason it decrypts the passwords on the server,” he says. For one thing, relying on third-party servers makes the product slower and less reliable. More to the point, if a hacker breaches N-able or any of its customers, they can still glean Passportal key material in transit. “It just provides such a huge attack surface that other password managers typically don’t have,” Arnott warns.
At the end of the day, Arnott says, “If I found out my password manager didn’t have end-to-end encryption, there’s no way I would use it.”
In response to a Dark Reading query on that front, N-able wrote, “We are committed to the ongoing security and integrity of Passportal and are continuously evaluating further hardening measures.”
Comments are closed