KeePass Password Manager vulnerability: what you need to know
..The Federal Cyber Emergency Team of Belgium, cert.be, released a warning regarding KeePass. According to the warning, attackers with write access to the KeePass configuration file may modify it with triggers to export the entire password database in cleartext without user confirmation…
The vulnerability described requires write access to the KeePass configuration file. An attacker has to add a trigger to the file that executes when a password database file is open to export the data silently in the background. Passwords are saved in clear text to a file and the attacker would need to obtain that file later on to gain access to all stored passwords…
Keepass – https://keepass.info/help/kb/sec_issues.html#cfgw
Write Access to Configuration File
An attacker who has write access to the KeePass configuration file can modify it maliciously (for example, he could inject malicious triggers). This is not really a security vulnerability of KeePass though.
If the user has installed KeePass using the setup program, the configuration file is stored in the user’s application data directory (in “%APPDATA%\KeePass”), which is within the user profile directory (“%USERPROFILE%”). In this case, having write access to the KeePass configuration file is typically equivalent to having write access to the user profile directory. Someone who has write access to the user profile directory can perform various kinds of attacks. For example, the attacker could add malware in the startup folder (“%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup”; the malware will run automatically after the next user logon), modify desktop shortcuts (in “%USERPROFILE%\Desktop”), manipulate the user’s registry (file “%USERPROFILE%\NTUSER.DAT”), modify configuration files of other applications (for instance to make a browser open a malicious website automatically), and so on.
If the user is using the portable version of KeePass, the configuration file is stored in the application directory (which contains the “KeePass.exe” file). In this case, having write access to the KeePass configuration file is typically equivalent to having write access to the application directory. With this capability, an attacker can for instance simply replace the “KeePass.exe” file by some malware.
In both cases, having write access to the KeePass configuration file typically implies that an attacker can actually perform much more powerful attacks than modifying the configuration file (and these attacks in the end can also affect KeePass, independent of a configuration file protection).These attacks can only be prevented by keeping the environment secure (by using an anti-virus software, a firewall, not opening unknown e-mail attachments, etc.). KeePass cannot magically run securely in an insecure environment…
