CVE-2024-33669 Overview
CVE-2024-33669 affects the Passbolt Browser Extension in versions prior to 4.6.2. The extension sends multiple requests to the HaveIBeenPwned (HIBP) Pwned Passwords API while a user types a password. An attacker able to observe the extension's HTTPS traffic to the HIBP API can correlate the request patterns with keystrokes and reduce the search space for brute forcing manually typed passwords. The issue is categorized as an information exposure weakness [CWE-200] and stems from the extension's implementation of real-time password breach checks. Passbolt published an incident report and released a fix in version 4.6.2.
Critical Impact
An on-path observer of HTTPS metadata to the Pwned Passwords API can significantly accelerate offline brute-force recovery of passwords being typed by a Passbolt user.
Affected Products
- Passbolt Browser Extension versions before 4.6.2
- Deployments relying on the client-side Pwned Password check feature
- Users typing passwords manually into the Passbolt extension
Discovery Timeline
- 2024-04-26 - CVE-2024-33669 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-33669
Vulnerability Analysis
The Passbolt Browser Extension integrates with the HaveIBeenPwned Pwned Passwords API to warn users when a password appears in known breach corpora. To preserve privacy, HIBP uses a k-anonymity model where clients submit only the first five characters of a SHA-1 hash and receive a list of matching suffixes. The extension issued a new request for each character typed rather than debouncing input or waiting for a completed password.
This behavior produced a stream of distinct HTTPS requests whose sizes, timing, and hash prefixes could be observed by an attacker positioned to see the encrypted traffic. Although TLS protects request contents, request cardinality and the five-character hash prefix each request carries reduce the entropy an attacker must brute force offline. The vulnerability is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.
Root Cause
The root cause is a design flaw in the client-side password health check. The extension queries HIBP incrementally on every keystroke, exposing intermediate hash prefixes for each partial password state. Combined with observable timing, this leaks structural information about the password being typed even though the full plaintext never leaves the browser.
Attack Vector
Exploitation requires a network-adjacent adversary capable of observing the user's HTTPS traffic to api.pwnedpasswords.com. Suitable observation points include compromised network devices, malicious upstream proxies, TLS-inspecting middleboxes, or a hostile local network operator. The attacker collects the sequence of five-character SHA-1 prefixes and the timing between requests, then uses the ordered prefixes to constrain candidate passwords in an offline brute-force stage. The Quarkslab research write-up documents the analytical approach in detail.
See the Quarkslab blog on Passbolt and the Passbolt Incident Report for technical background.
Detection Methods for CVE-2024-33669
Indicators of Compromise
- Repeated outbound HTTPS connections from a browser process to api.pwnedpasswords.com clustered within short intervals matching human typing cadence.
- Presence of the Passbolt Browser Extension at a version earlier than 4.6.2 in endpoint inventory data.
- Network flow records showing many small requests to the Pwned Passwords API from a single browser session.
Detection Strategies
- Inventory installed browser extensions across managed endpoints and flag Passbolt extension builds below 4.6.2.
- Correlate DNS and TLS SNI telemetry for api.pwnedpasswords.com with the originating process to identify hosts still running vulnerable versions.
- Alert on abnormal request bursts to the Pwned Passwords API originating from a single user session, which is consistent with the pre-patch behavior.
Monitoring Recommendations
- Ingest browser extension inventory and version metadata into a central data lake for continuous version compliance checks.
- Monitor egress traffic to third-party password-breach APIs and baseline expected request volume per user.
- Track deployment status of Passbolt version 4.6.2 or later through configuration management tooling.
How to Mitigate CVE-2024-33669
Immediate Actions Required
- Upgrade the Passbolt Browser Extension to version 4.6.2 or later on every managed endpoint.
- Instruct users to avoid typing high-value passwords into the extension on untrusted networks until patching is verified.
- Review browser extension update policies to ensure automatic updates are enabled where supported.
Patch Information
Passbolt addressed the issue in Passbolt Browser Extension 4.6.2. The fix changes when and how the extension calls the Pwned Passwords API so that partial password states are no longer submitted on each keystroke. Refer to the Passbolt Incident Report for the vendor's remediation notes and the Passbolt security page for release information.
Workarounds
- Disable the client-side Pwned Password check feature in Passbolt configuration until the extension is updated.
- Route Passbolt traffic through a trusted VPN to reduce exposure to on-path observers on untrusted networks.
- Use the Passbolt-generated random passwords rather than manually typed passwords to eliminate the keystroke-driven request pattern.
# Verify installed Passbolt Browser Extension version and confirm it is 4.6.2 or later
# Chrome/Chromium on Linux
ls ~/.config/google-chrome/Default/Extensions/didegimhafipceonhjepacocaffmoppf/
# Firefox on Linux
grep -A2 'passbolt' ~/.mozilla/firefox/*.default*/extensions.json | grep version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
