KeePass, a widely used password manager application, is vulnerable to a security flaw that gives the threat actors ability to extract the master password from the memory of the app.
This vulnerability poses a significant risk as attackers can retrieve the password even when the database is locked, putting user data at risk if a device is compromised.
A security researcher named ‘vdohney’ identified the vulnerability and tracked the flaw as “CVE-2023-3278.” While apart from this, the researcher also developed a proof-of-concept tool (KeePass Master Password Dumper) to demonstrate how attackers can extract the KeePass master password from memory.
KeePass Password Vulnerability
Password managers eliminate the need to memorize multiple passwords for every account by generating distinct or unique passwords for each and storing them securely.
To ensure the security of the password vault, users need to remember a single master password that encrypts the KeePass database, restricting access to stored credentials.
If the master password is compromised, then unauthorized individuals could gain unrestricted access to all the credentials stored within the database, posing a serious threat.
To ensure robust security for a password manager, users must prioritize safeguarding their master password and refrain from sharing it with others.
The vulnerability, CVE-2023-3278, allows for retrieving the KeePass master password in clear text form, except for the first few characters, regardless of the locked workspace, enabling the recovery of most of the passwords in plaintext form.
A memory dump from various sources, such as process dump, swap file, hibernation file, or RAM dump, can be utilized without requiring code execution on the target system.
The flaw stems from KeePass 2.X’s usage of a custom password entry box called “SecureTextBoxEx,” which inadvertently stores traces of user-typed characters in memory, posing a risk for recovering passwords not only for the master password but also for other password edit boxes within KeePass.
The vulnerability, CVE-2023-32784, affects KeePass 2.53.1 and potentially its forks. However, it seems that the flaw doesn’t affect the:-
- KeePassXC
- Strongbox
- KeePass 1.X
While the exploit is not limited to Windows and can be adapted for Linux and macOS, as it stems from how KeePass handles user input rather than being OS-specific.
Recommendation
Here below, we have mentioned all the security steps that the expert offers to secure your app:-
- Make sure to change your master password immediately.
- Delete the hibernation file.
- Make sure also to delete the pagefile/swapfile.
- To prevent carving, overwrite the deleted data on the HDD.
- Lastly, restart your system.
Struggling to Apply The Security Patch in Your System? –
Try All-in-One Patch Manager Plus
