Keepass developers, after numerous complaints of users, refused to recognize the existing vulnerability, which allows the attacker to invisibly export the entire database in the open form.
Error cve-2023-24055 (CVSS: 5.5) allows a cybercriminator who has access to the target system, change the XML FILE OF KEEPASS configuration and introduce a malicious trigger that exports the database, including all user names and passwords in open form.
The next time the target will launch Keepass and introduce a master parole, the rule of export will work, and the contents of the database will be saved in a file that the hacker will be able to later be expliciting to its server. Moreover, the export process is launched in the background without notifying the user or Keepass request to enter the master parole as confirmation before export, which allows the attacker to imperceptibly gain access to all saved passwords.
Although the groups is cert Netherlands and Belgium We have issued security recommendations for this error, a team of developers Keepass claims that this drawback is not a vulnerability, given that the attacker can also access the Keepass database in other ways. It is worth noting that in the Keepass reference center the problem “ write access to configuration file ” exists ” Since April 2019, it has not been considered a vulnerability of Keepass safety.
If the user installed Keepass as an ordinary program and attackers have access to recording, they can also “perform various kinds of attacks”, for example, replace the executable KEEPAS file malicious software.
If the developers do not provide a correction of the problem, users can independently protect their database by entering the system as an administrator and Creating a compulsory configuration file , which has priority over the parameters, including malicious triggers. It is important to note that the configuration file should be located in the same catalog as the executable Keepass file – otherwise, the hacker will be able to circumvent this protection.