A vulnerability has been discovered in the KeePass password manager software (v2.X) that allows an attacker to dump the master password from the program’s memory.
This vulnerability (CVE-2023-32784) was discovered by security researcher Dominik Reichl and will be resolved in KeePass 2.54, released in early June 2023.
Reichl described the flaw in a security report published on GitHub on Thursday that said the vulnerability could only be exploited if the master password was typed in at the keyboard, not copied from the clipboard. also revealed.
The KeePass flaw involves a text box called SecureTextBoxEx that is used to enter passwords. Typing a character creates a lingering string in memory, and .NET behavior makes it difficult to remove.
For example, when you enter “Password”, characters such as •a, ••s, •••s, •••w, •••••o, ••••••r, ••••• column remains. ••d is stored in memory. A proof-of-concept (POC) application developed by Reichl was able to scan a memory dump and suggest possible password characters at each location.
Additionally, this attack does not require code execution on the target system, only a memory dump. Memory can be obtained from various files, including full system RAM dumps. Since passwords can be extracted from memory even after KeePass is no longer running, this vulnerability could also bypass a locked workspace state (although the likelihood of doing so diminishes over time). increase).
More information on memory vulnerability exploits can be found here: New Lenovo Notebook Models Affected by UEFI Firmware Vulnerability
To mitigate the risks associated with this vulnerability, users are advised to update to KeePass 2.54 or later versions when available.
In the meantime, Reichl advises KeePass users to change their master password, restart their computers, delete hibernation and pagefiles/swapfiles, and hard disk drives (HDDs) to prevent data carving. We recommended overwriting the deleted data above.
For maximum security, we also recommend performing a fresh installation of the operating system (OS).
The developer also revealed that some KeePass-based products such as KeePassXC, Strongbox and KeePass 1.X are not affected by this vulnerability.
This security bulletin comes months after the LastPass breach brought password managers to the forefront.
