Vulnerability found in KeePass password manager that allows extraction of master password

A vulnerability has been discovered in the popular password manager KeePass, which, if exploited, allows extracting the master password from the application’s memory. Due to this, attackers who managed to compromise the victim’s device can steal all the passwords stored in the manager, even if the database is locked.

Image source: hothardware.com

The mentioned vulnerability is tracked under the identifier CVE-2023-3278. It was discovered by a researcher in the field of information security, known under the nickname vdohney. He published a brief description of the problem and a PoC exploit on GitHub that exploited the KeePass vulnerability. The issue affects KeePass 2.53 and earlier versions of the application.

The fact is that KeePass uses the SecureTextBoxEx field to enter a password, which saves the characters entered by the user in memory in clear text. This means that it is enough for an attacker to get hold of a memory dump, and this can be a dump of a process, a page file pagefile.sys, a hibernation file hiberfil.sys, various crash dumps, or a memory dump of the entire system. It also doesn’t matter if the workspace is locked or not or if KeePass is running.

The exploit has been tested on Windows, but a patched version is likely to work on macOS as well, as the vulnerability is related to the way the application handles data when entering a password, and not to the operating system itself. The vulnerability is expected to be fixed in KeePass 2.54, which should be launched in the next few weeks.