Pierluigi Paganini June 05, 2023

KeePass addressed the CVE-2023-32784 bug that allows the extraction of the cleartext master password from the memory of the client.

KeePass has addressed the CVE-2023-32784 vulnerability, which allowed the retrieval of the clear-text master password from the client’s memory.

KeePass is a free and open-source software used to securely manage passwords. It functions as a digital “safe” where users can store and organize their sensitive information, including passwords, credit card numbers, notes, and other sensitive information. KeePass encrypts the data using a master key or master password that you need to provide in order to access the stored information.

The company fixed the bug with the release of KeePass version 2.54.

In mid-May, security researcher Vdohney released a PoC tool called KeePass 2.X Master Password Dumper that allows retrieving the master password for KeePass.

The expert explained that the tool exploits the unpatched CVE-2023-32784 flaw to retrieve the master password from the memory of KeePass 2.x versions.

The problem stems from the use of a custom-developed text box (‘SecureTextBoxEx’) for password entry in the KeePass 2.X. This text box is not only used for the master password entry, but in other places in KeePass as well, like password edit boxes allowing an attacker to use it to recover their contents.

For every character typed, a leftover string is created in memory.

“Because of how .NET works, it is nearly impossible to get rid of it once it gets created. For example, when “Password” is typed, it will result in these leftover strings: •a, ••s, •••s, ••••w, •••••o, ••••••r, •••••••d.” “The POC application searches the dump for these patterns and offers a likely password character for each position in the password.” reads the post published by the Vdohney.

The success of the attack depends on how the password was typed and how many passwords were typed per session. The expert explained that even if there are multiple passwords per session or typos, the way .NET CLR allocates these strings means that they are likely to be nicely ordered in memory. For example, if the user typed three different passwords, the attacker is likely to get three candidates for each character position in that order, allowing to recover all three passwords.

The researchers pointed out that the password can be retrieved only when it has been typed on a keyboard, not copied from a clipboard. 

The most recent release of the popular password manager utilizes a Windows API to handle data from text boxes, effectively preventing the creation of managed strings that could be extracted from memory.

Users that cannot upgrade their installs are recommended to:

• Change the master password
• Delete hibernation file
• Delete pagefile/swapfile
• Overwrite deleted data on the HDD to prevent carving (e.g. Cipher with /w on Windows)
• Restart the computer

Or just overwrite their HDD and do a fresh install of the OS.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, KeePass)