PoC Tool Exploits Unpatched KeePass Vulnerability to Retrieve Master Passwords

[MuzzMelbourne]

Content source

https://www.securityweek.com/poc-tool-exploits-unpatched-keepass-vulnerability-to-retrieve-master-passwords/

A researcher has published a proof-of-concept (PoC) tool that exploits an unpatched KeePass vulnerability to retrieve the master password from the program’s memory.

An open source password manager primarily designed for Windows, KeePass can also be used on macOS and Linux, through the open source .NET-compatible framework Mono.

Tracked as CVE-2023-32784, the issue impacts KeePass 2.x versions and allows an attacker to retrieve the cleartext master password from a memory dump. The flaw is exploitable even on workspaces that have been locked or are no longer running.

“The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered,” a NIST advisory reads.

PoC Tool Exploits Unpatched KeePass Vulnerability to Retrieve Master Passwords

Researcher publishes PoC tool that exploits unpatched KeePass vulnerability to retrieve the master password from memory.

www.securityweek.com

 

[Gandalf_The_Grey]

PoC Tool Exploits Unpatched KeePass Vulnerability to Retrieve Master Passwords

Researcher publishes PoC tool that exploits unpatched KeePass vulnerability to retrieve the master password from memory.

www.securityweek.com

Even if the official patch is months away, there is no reason to panic, Vdohney says. The vulnerability cannot be exploited remotely, meaning that, unless the computer is already infected with malware, users should not be worried about this flaw’s exploitation.

 

[Zero Knowledge]

meaning that, unless the computer is already infected with malware

Not really reassuring. So, it is exploitable and the fact that one of the first things an skilled attacker would do is to attack KeePass to get juicy data.

 

[Ink]

PSA: KeePassXC is not affected by this vulnerability.

CVE-2023-32784 : is KeepassXC affected ? · keepassxreboot/keepassxc · Discussion #9433

CVE-2023-32784 (https://www.it-connect.fr/keepass-cve-2023-32784-recuperer-mot-de-passe/?utm_content=cmp-true) seems to affect the original client on windows. Is KeepassXC affected as it is written...

github.com