1Password, recognized as one of the top password management tools available today, has advised Mac users to promptly install a security patch following the identification of a vulnerability that could enable cybercriminals to access user vaults.
This software permits individuals to establish separate password vaults within the application, facilitating a clear division between personal and professional credentials.
The security flaw is categorized under CVE-2024-42219, with a CVSS score of 7.0, allowing potential attackers on machines running 1Password version 8.10.36 for macOS to pilfer complete password lists.
Exposing the Vulnerability
The weakness was uncovered by cybersecurity professionals at Robinhood during their examination of the 1Password application for possible vulnerabilities. The National Vulnerability Database explains this issue as enabling “local adversaries to extract vault items due to inadequate XPC inter-process communication validation.”
According to an official notice, it has been detailed that ”to exploit this vulnerability, an attacker must deploy harmful software on a system aimed specifically at targeting 1Password for Mac.” This can lead adversaries to take advantage of absent macOS-specific inter-process validations, ultimately allowing them to impersonate legitimate components like the 1Password browser extension or command line interface (CLI).
“This unauthorized access would empower malicious programs not only to collect vault items but also secure derived credentials needed for signing into 1Password—specifically elements such as the account unlock key and ‘SRP-x’.”
For attackers seeking exploitation methods, deceiving users into installing tailored applications remains necessary; however, there are no reports confirming that such attacks have occurred in practical scenarios.
Currently, around 150,000 organizations depend on 1Password for managing crucial identifiers; however, it remains uncertain how many utilize macOS systems specifically. It’s important to note that users operating on Windows platforms are not impacted by this defect.
Explore More from TechRadar Pro
- The finest antivirus solutions available for Mac
- A massive data breach exposes information regarding billions—here’s what we know up until now
- Check out our comprehensive guide on leading free password managers
