KeePass Exploit Allows Attackers to Recover Master Passwords from Memory

A proof-of-thought (PoC) has been produced out there for a security flaw impacting the KeePass password supervisor that could be exploited to recover a victim’s master password in cleartext less than certain circumstances.

The issue, tracked as CVE-2023-32784, impacts KeePass versions 2.x for Windows, Linux, and macOS, and is anticipated to be patched in model 2.54, which is likely to be launched early next thirty day period.

“Aside from the 1st password character, it is generally capable to recover the password in plaintext,” security researcher “vdhoney,” who found the flaw and devised a PoC, explained. “No code execution on the focus on procedure is expected, just a memory dump.”

“It would not subject where by the memory comes from,” the researcher added, stating, “it doesn’t make any difference no matter whether or not the workspace is locked. It is also achievable to dump the password from RAM following KeePass is no for a longer time working, though the likelihood of that doing the job goes down with the time it really is been due to the fact then.”

It is really worth noting that effective exploitation of the flaw financial institutions on the affliction that an attacker has previously compromised a potential target’s laptop or computer. It also calls for that the password is typed on a keyboard, and not copied from a clipboard.

vdhoney explained the vulnerability has to do with how a customized text box discipline used for getting into the master password handles consumer enter. Particularly, it has been identified to go away traces of each individual character the person kinds in the method memory.

This prospects to a circumstance whereby an attacker could dump the program’s memory and reassemble the password in plaintext with the exception of the to start with character. People are encouraged to update to KeePass 2.54 once it gets accessible.

Impending WEBINARZero Belief + Deception: Understand How to Outsmart Attackers!

Discover how Deception can detect innovative threats, cease lateral movement, and enrich your Zero Have faith in method. Join our insightful webinar!

Conserve My Seat!

The disclosure arrives a number of months right after an additional medium-severity flaw (CVE-2023-24055) was uncovered in the open resource password manager that could be potentially exploited to retrieve cleartext passwords from the password databases by leveraging create access to the software’s XML configuration file.

KeePass has managed that the “password database is not supposed to be protected towards an attacker who has that level of accessibility to the nearby Computer.”

It also follows results from Google security investigate that comprehensive a flaw in password managers these kinds of as Bitwarden, Dashlane, and Safari, which can be abused to car-fill saved credentials into untrusted web web pages, leading to possible account takeovers.

Found this write-up fascinating? Follow us on Twitter  and LinkedIn to read through far more exclusive written content we put up.

Some parts of this article are sourced from:
thehackernews.com