KeePass CVE-2023-32784: Detection of Processes Memory Dump

A new vulnerability CVE-2023-32784 was discovered that affected KeePass. KeePass is a popular open source password manager which runs on Windows, Mac, or Linux. The vulnerability allows the extraction of the master key in cleartext from the memory of the process that was running. The master key will allow an attacker to access all the stored credentials.

We strongly recommend updating to KeePass 2.54 to fix the vulnerability.

In this article we explain the new vulnerability CVE-2023-32784, how it works, and how to detect this type of attack when the attacker gains full access to your system and performs advanced techniques to steal your credentials.

Credentials in Memory Linux

When we talk about credentials in Linux, we usually think of the /etc/shadow file, but that is not the only place where passwords can be stored. Many processes also store credentials in memory, which malicious tools will try to extract. For example, the proc directory described below is a popular vector for this type of attack.

From the Linux Kernel Doc:

“The directory /proc contains (among other things) one subdirectory for each process running on the system, which is named after the process ID (PID).”

MITRE defined that the adversaries may gather credentials from the proc filesystem as OS Credential Dumping: Proc Filesystem T1003.007.

What is KeePass CVE-2023-32784?

CVE-2023-32784 allows the recovery of the cleartext master password from a memory dump. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system.

KeePass 2.X uses a custom-developed text box for password entry, SecureTextBoxEx. The flaw exploited in this CVE is that for every character typed, a leftover string is created in memory. Because of how .NET works, it is nearly impossible to get rid of it once it gets created. For example, when “Password” is typed, it will result in these leftover strings: •a, ••s, •••s, ••••w, •••••o, ••••••r, •••••••d. The first character cannot be recovered.

The PoC we use follows the steps below to extract the KeePass secret key:

First, scan all /proc/<pid>/cmdline files and store the pid of ones with the keyword KeePass.

Then, acquire the addresses of memory maps in /proc/<pid>/maps that aren’t directly associated with a library.

Finally, store the memory of all those maps into a buffer by taking advantage of /proc/<pid>/mem. Parse the memory to try and find leftover strings from when the user typed their master password, strings that look like •a, ••s, •••s, in sequence.

As we can see in the image above, the master key is exposed without the first character.

How to Detect KeePass CVE-2023-32784

To detect this type of attack, we should be able to monitor access to the /proc folder by an unknown process. This will trigger an alert and we can investigate further.

If we try to detect this with Falco, an open source project under the CNCF, it provides real-time detection of unusual activities in cloud-native environments by sending alerts. In this scenario, we need to adjust the rule Read environment variable from /proc files or create a new one.

To correctly trigger this rule, we should modify the condition to catch the read of /proc/<pid>/cmdline, /proc/<pid>/maps, or /proc/<pid>/mem, which is used in the PoC to obtain the KeePass master password.

With this new rule, we are able to detect the exploitation of CVE-2023-32784.

The alert contains all the information we needed to continue investigating the threat.

As mentioned in the exploit, if the attacker has sufficient permissions and capabilities within your machine, the attacker may be able to perform any malicious action. However, this rule can give us an indication of whether our credentials have been breached and act accordingly.

Reference:https://sysdig.com/blog/keepass-cve-2023-32784-detection/

M.H