5.17 Security Bulletin
Passbolt 5.17 incorporates various security enhancements and hardening measures resulting from comprehensive internal assessments and external research.
These updates cover areas such as multi-factor authentication hardening, server-side request forgery (SSRF) prevention, SCIM authentication, browser extension security, and more. CVEs have been requested where appropriate and will be published once assigned.
We strongly advise all administrators to update to Passbolt 5.17 or newer to ensure the security of their instances.
Security Vulnerabilities
PB-54703 - SSRF egress guard bypass in Passbolt 5.15.0 SSO provider URL validation (high)
Product: Passbolt Pro API < 5.17
Problem: The SSO egress guard component fails to block access to internal network addresses. It is not recognizing alternative IP address formats correctly, and not processing square brackets in IPv6 address.
Impact: A rogue administrator could exploit this issue to bypass network restrictions and reach sensitive internal services that should not be reachable.
Solution: The egress guard has been updated to reject non-standard IP formats, properly parse IPv6 addresses, and block unresolvable hostnames by default.
Remaining risk: DNS rebinding remains a known, accepted risk and is not addressed by this fix.
CVE: N/A
Severity: CVSS 7.6 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N)
Credit: Cico Agung
PB-54638 - Avatar upload allows for blind SSRF (medium)
Product: Passbolt Pro API < 5.17
Problem: A vulnerability in Passbolt's avatar upload validation allows authenticated users to submit a plain text string, such as a URL, instead of an actual file. Because input validation occurs before verifying file structure, PHP stream wrappers process the string, triggering unintended network connections or filesystem operations on the server.
Impact: An authenticated user can exploit this behavior to perform blind Server-Side Request Forgery (SSRF), probing internal hosts/ports and using filesystem oracles to infer file existence. However the attack is blind (returning no response bodies) and cannot disclose data or execute remote code.
Solution: Passbolt updated the avatar validation routine to strictly require a valid uploaded file interface prior to conducting MIME type or filesystem checks. Arbitrary strings and URLs supplied via JSON requests are now immediately rejected.
CVE: N/A
Severity: CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L)
Credit: Google and Ada Logics
PB-54640 - The MFA brute-force limiter never counts failed TOTP codes submitted to the JSON endpoint (medium)
Product: Passbolt Pro API < 5.17
Problem: A vulnerability in the MFA rate-limiting implementation allows failed Time-based One-Time Password (TOTP) verification attempts submitted via JSON endpoints to bypass failure tracking.
Impact: An attacker who has already acquired a target user's primary credentials can exploit this to execute unthrottled, continuous brute-force guesses against the 6-digit TOTP code.
Solution: The system remediates the issue by updating the underlying rate limiter logic to consistently count failed MFA attempts across all authentication types and response formats without resetting or bypassing counters. Additionally, a new global configuration option has been introduced to automatically disable affected user accounts, invalidate active sessions and tokens, and notify both users and administrators when the failure threshold is reached.
CVE: N/A
Severity: CVSS 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Credit: Google and Ada Logics
Security Improvements
This section contains items that are classified as security improvements and hardening measures rather than directly exploitable vulnerabilities. In most cases, exploitation is theoretical, requires specific conditions outside Passbolt’s control, affects functionality not currently exposed by Passbolt clients, or relates to previously documented risks with mitigations already in place.
PB-52439 - SCIM bearer tokens expiry enforcement (Info)
Product: Passbolt Pro API < 5.15
Problem: The SCIM token expiry date was originally intended as a user-configured reminder to prompt token rotation, rather than an enforced authentication deadline. Tokens therefore remained valid after this date. However, the term “expiry” implied that tokens would automatically stop authenticating, creating a mismatch between the feature’s intended behavior and users’ expectations.
Impact: A compromised SCIM bearer token could continue to access provisioning endpoints after its configured expiry date, until explicitly revoked. Administrators relying on that date to limit a token’s lifetime could consequently leave access active longer than intended.
Solution: Token expiry now has a stricter implementation aligned with its expected meaning. When expiry enforcement is enabled through the new configurable flag, authentication checks reject expired tokens with an unauthorized response following the SCIM 2.0 Error schema. A healthcheck identifies tokens approaching expiry, and automated daily emails notify system administrators of tokens nearing expiry or already expired, supporting timely rotation.
Credit: Cure53
PB-52830 - PBL-17-002 - Incorrect cookie scoping in native fetch (Info)
Product: Passbolt Browser Extension < 5.17 (Safari)
Problem: The browser extension queries cookies using a domain value rather than the full request URL, which causes it to retrieve and forward cookies (including host-only, path-restricted, and secure cookies) that exceed what a standard browser would include for the request.
Impact: Theoretically, this leads to unintended cross-host cookie exposure and violates browser cookie isolation boundaries, potentially transmitting subdomain-specific or secure cookies outside their intended scope. Currently, no reliable exploitation path has been identified.
Solution: The system now strictly ensures that the targeted domain matches the cookies domain excluding the subdomains.
Credit: Cure53
PB-52831 - PBL-17-003 - Cookie preserved across HTTPS-to-HTTP redirects (Info)
Product: Passbolt Browser Extension < 5.17 (Safari)
Problem: The session manager validation checks only the hostname during redirects without enforcing scheme consistency or validating the destination port. As a result, an HTTPS request can be redirected to an HTTP endpoint or a different port on the same host while keeping associated cookies intact.
Impact: Cookies are transmitted over unencrypted HTTP connections, allowing intermediary network devices to observe plaintext cookie values. An adversary obtaining these cookies could potentially impersonate the user, though the impact is classified as informational since an attacker capable of manipulating the redirect response typically already has visibility into the original request.
Solution: Enforced scheme consistency and destination port validation within the redirect policy to prevent same-host scheme downgrades and unintended cookie transmission over unencrypted channels.
Credit: Cure53
PB-52832 - PBL-17-004 - Misconfigured resource URL allowlist (Info)
Product: Passbolt Browser Extension < 5.17
Problem: Before opening a resource URL, the extension performs URL validation and only permits the HTTP and HTTPS schemes. A casing mismatch that exists in the allowlist option causes the custom option to be ignored.
Impact: There is no immediate security impact, as a default fallback check already restricts URLs to HTTP and HTTPS. However, it represents a latent defect that could lead to unexpected behavior if default configurations change or custom protocol restrictions are introduced in the future.
Solution: The option name has been corrected to lowercase to match the case ensuring proper configuration alignment.
Credit: Cure53
PB-54842 - Clipboard auto-clear bypass via untrusted copy/cut DOM event (info)
Product: Passbolt Browser Extension < 5.17
Problem: The extension relies on listening for web page copy/cut events to clear sensitive data from the clipboard after a designated timeout. A malicious or compromised web page can intercept these DOM events using untrusted background scripts or event listeners, resetting or canceling the timer and preventing the automated clipboard flush from executing.
Impact: An attacker from a website can ensure that a secret remains in the clipboard for a longer period of time than the user expects. Using another software or extension with access to the clipboard, this additional delay could be used to steal sensitive information from the clipboard.
Solution: The extension now validates event trustedness on clipboard DOM events, ensuring the action is genuinely user-initiated rather than generated by programmatic scripts before altering the auto-clear timer.
Credit: Alex J
