Error when trying to export unencrypted organization vault via web interface

[f1d094]

Subject of the issue

Plaintext export of personal vault data works as expected. It is also possible to create an encrypted_json export of organization data. Plaintext exports of Organization vaults fail for both .csv and .json.

Encrypted exports are not useful for disaster recovery, where it is entirely possible the encryption key may be lost, preventing re-import of an encrypted .json file.

Unencrypted exports are essential for proper backups

Deployment environment

Your environment (Generated via diagnostics page)

• Vaultwarden version: v1.25.2-9c891baa
• Web-vault version: v2022.9.0
• Running within Docker: true (Base: Debian)
• Environment settings overridden: false
• Uses a reverse proxy: true
• IP Header check: true (X-Forwarded-For)
• Internet access: true
• Internet access via a proxy: false
• DNS Check: true
• Time Check: true
• Domain Configuration Check: true
• HTTPS Check: true
• Database type: SQLite
• Database version: 3.35.4
• Clients used:
• Reverse proxy and version:
• Other relevant information:

Config (Generated via diagnostics page)

Show Running Config

Environment settings which are overridden:

{
  "_duo_akey": null,
  "_enable_duo": false,
  "_enable_email_2fa": true,
  "_enable_smtp": true,
  "_enable_yubico": true,
  "_icon_service_csp": "",
  "_icon_service_url": "",
  "_ip_header_enabled": true,
  "admin_ratelimit_max_burst": 3,
  "admin_ratelimit_seconds": 300,
  "admin_token": "***",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_conn_init": "",
  "database_max_conns": 10,
  "database_timeout": 30,
  "database_url": "****/**.*******",
  "db_connection_retries": 15,
  "disable_2fa_remember": true,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "domain": "*****://******.******.**:*****",
  "domain_origin": "*****://******.******.**:*****",
  "domain_path": "",
  "domain_set": true,
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "email_attempts_limit": 3,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "emergency_access_allowed": true,
  "emergency_notification_reminder_schedule": "0 5 * * * *",
  "emergency_request_timeout_schedule": "0 5 * * * *",
  "enable_db_wal": true,
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "icon_redirect_code": 302,
  "icon_service": "internal",
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "invitation_org_name": "Vaultwarden",
  "invitations_allowed": true,
  "ip_header": "X-Forwarded-For",
  "job_poll_interval_ms": 30000,
  "log_file": "/data/logfile",
  "log_level": "Info",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "login_ratelimit_max_burst": 10,
  "login_ratelimit_seconds": 60,
  "org_attachment_limit": null,
  "org_creation_users": "*****@******.****",
  "password_hints_allowed": true,
  "password_iterations": 100000,
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sends_allowed": true,
  "sends_folder": "data/sends",
  "show_password_hint": false,
  "signups_allowed": false,
  "signups_domains_whitelist": "",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": null,
  "smtp_debug": false,
  "smtp_explicit_tls": null,
  "smtp_from": "***********@******.**",
  "smtp_from_name": "Vaultwarden",
  "smtp_host": "***.**.**.**",
  "smtp_password": "***",
  "smtp_port": 1025,
  "smtp_security": "off",
  "smtp_ssl": null,
  "smtp_timeout": 15,
  "smtp_username": "*******",
  "templates_folder": "data/templates",
  "tmp_folder": "data/tmp",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_syslog": false,
  "user_attachment_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "websocket_address": "0.0.0.0",
  "websocket_enabled": false,
  "websocket_port": 3012,
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

• Install method: Docker Image

Steps to reproduce

After logging in as the Organization owner, then Organizations -> MyOrganization -> Tools -> Export Vault

Expected behaviour

Unencrypted .json file with organization vault data

Actual behaviour

Selecting File Format "Encrypted .json" and entering Master Password returns encrypted .json file.
Selecting ".json" or ".csv" produces "An unexpected error has occured" in the GUI

Troubleshooting data

With extended logging enabled and LOG_LEVEL=info, the following appears in the log

[2022-09-23 22:14:29.602][request][INFO] GET /api/organizations/********-****-****-************/export
[2022-09-23 22:14:29.603][_][WARN] Response was `None`.
[2022-09-23 22:14:29.603][_][WARN] No 404 catcher registered. Using Rocket default.
[2022-09-23 22:14:29.603][response][INFO] (web_files) GET /<p..> [10] => 404 Not Found

Setting LOG_LEVEL=debug and trying again produces identical output in the log.

Trying to do export with bw cli results in same issues as #2760

[BlackDex]

Duplicate of #2760

[f1d094]

Is this the same? #2760 only speaks to cli. I am unable to create backups via GUI. This should be a bug, not an enhancement, no?

[BlackDex]

Yes it is the same. It's the exact same endpoint (and I changed the title).
And bug or enhancement sometimes are synonyms 😉

[f1d094]

What is the last known-good version if I wanted to roll back? This was my first effort with bitwarden/vaultwarden

[BlackDex]

I would suggest to use the latest tagged images instead of testing