KeePassXC Vulnerability CVE-2023–35866
Introduction
KeePassXC, a widely used open-source password manager, is renowned for its robust security features and the ability to protect sensitive user information. However, recent observations by CyberCitizen.tech raised concerns regarding security-setting changes within the KeePassXC-Database. Notably, CyberCitizen and other users have noticed that a confirmation through the master password or the set-up second-factor is not required when making modifications to security settings. In this article, we delve into the implications of this issue and discuss the importance of enhancing security measures in KeePassXC.
The Timeline of Vulnerablity reporting
- 21/03/2023 Submitted first report to KeePassXC Team privately.
- 21/03/2023 Answer received that this is not considered a Vulnerability but a cosmetic GUI feature.
- 22/03/2023 Double checked with KeePassXC Team, to ensure issue was understood.
- 22/03/2023 Received Confirmation that it was understood.
- 05/05/2023 Posted as Issue publicly on Github issues: #9391.
- 05/05/2023 KeePassXC Team scheduled this “feature” for Milestone v2.8.0.
- 19/06/2023 CVE-2023–35866 was assigned.
As of the writing of this article (19/06/2023), no ETA for v2.8.0. Current Release is 2.7.5.
The Importance of Security Settings
Security settings within a password manager serve as a vital defense mechanism against unauthorized access to sensitive information. These settings control aspects such as password requirements, encryption methods, and key file settings, ensuring that stored data remains secure. It is imperative that these settings are well-protected to maintain the integrity and confidentiality of user credentials.
The Security Setting Gap
The identified gap in KeePassXC’s security model is the absence of confirmation through the master password or the set-up second-factor when making changes to security settings within the KeePassXC-Database. This means that any individual with access to the (open) database can modify critical security configurations without providing proper authentication.
This security oversight compromises the very purpose of the master password and the set-up second-factor. These measures are designed to ensure that only authorized users with the correct credentials can access and modify security settings. Without these confirmation requirements, unauthorized individuals can tamper with security configurations, potentially compromising the security of stored data.
Addressing the Security Gap
To reinforce the security measures in KeePassXC and address the observed gap, the following actions can be considered:
Master Password Confirmation: Implement a mandatory master password confirmation whenever changes are made to security settings. Requiring the entry of the master password ensures that only authorized users with knowledge of the password can modify critical security configurations.
Second-Factor Authentication Confirmation: If set-up, introduce a requirement for second-factor authentication confirmation, such as the use of a physical key or other 2FA methods, when making changes to security settings. This step adds an additional layer of authentication, ensuring that only individuals with the necessary credentials can modify security configurations.
Regular Security Audits: Conduct routine security audits to identify and rectify potential vulnerabilities within KeePassXC. This includes regularly reviewing the codebase, engaging in penetration testing, and involving the security community to identify and address any security loopholes. (Interestingly, a recent security audit was performed: https://keepassxc.org/blog/2023-04-15-audit-report/)
User Education: promote user awareness about the importance of maintaining good security practices and the potential risks associated with the absence of confirmation requirements for security setting changes. Encourage users to regularly review their security settings, report suspicious activities, and stay informed about security updates and patches.
Conclusion
The absence of confirmation through the master password or the set-up second-factor when making changes to security settings in KeePassXC-Database is a significant security concern. By implementing the suggested measures, KeePassXC can strengthen its security model and provide users with a more robust and reliable password management solution. Maintaining the integrity of security settings is crucial to ensure the protection of sensitive information and uphold user trust in the software.
Please note: given the fact, that KeePassXC is fully open-source and based on a team of volunteers, this article is in no way meant to blame them. Instead it is meant as an honest way to support them and the community in order to increase the security posture.
