KeePass Exploit Allows Attackers to Recover Master Passwords from Memory

A proof-of-thought (PoC) has been created obtainable for a security flaw impacting the KeePass password manager that could be exploited to recuperate a victim’s learn password in cleartext below specific conditions.

The issue, tracked as CVE-2023-32784, impacts KeePass versions 2.x for Windows, Linux, and macOS, and is envisioned to be patched in version 2.54, which is very likely to be unveiled early upcoming thirty day period.

“Aside from the to start with password character, it is generally able to get well the password in plaintext,” security researcher “vdhoney,” who discovered the flaw and devised a PoC, said. “No code execution on the concentrate on program is expected, just a memory dump.”

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

“It will not make any difference the place the memory will come from,” the researcher additional, stating, “it does not make any difference regardless of whether or not the workspace is locked. It is also doable to dump the password from RAM immediately after KeePass is no more time operating, while the opportunity of that functioning goes down with the time it can be been since then.”

It can be worth noting that successful exploitation of the flaw financial institutions on the problem that an attacker has presently compromised a prospective target’s personal computer. It also necessitates that the password is typed on a keyboard, and not copied from a clipboard.

vdhoney explained the vulnerability has to do with how a personalized textual content box field utilized for coming into the grasp password handles consumer input. Exclusively, it has been located to go away traces of just about every character the consumer types in the system memory.

This leads to a state of affairs whereby an attacker could dump the program’s memory and reassemble the password in plaintext with the exception of the 1st character. Users are suggested to update to KeePass 2.54 as soon as it results in being available.

Future WEBINARZero Belief + Deception: Discover How to Outsmart Attackers!

Uncover how Deception can detect advanced threats, stop lateral motion, and improve your Zero Trust strategy. Be part of our insightful webinar!

Preserve My Seat!

The disclosure arrives a number of months following an additional medium-severity flaw (CVE-2023-24055) was uncovered in the open supply password supervisor that could be perhaps exploited to retrieve cleartext passwords from the password databases by leveraging create accessibility to the software’s XML configuration file.

KeePass has managed that the “password databases is not supposed to be secure from an attacker who has that degree of access to the neighborhood Computer system.”

It also follows results from Google security investigation that in depth a flaw in password administrators this sort of as Bitwarden, Dashlane, and Safari, which can be abused to auto-fill saved credentials into untrusted web web pages, primary to feasible account takeovers.

Located this posting appealing? Stick to us on Twitter  and LinkedIn to read through much more distinctive content material we submit.