CVE-2020-16271
📋 TL;DR
This vulnerability in KeePassRPC's SRP-6a implementation generates insufficiently random numbers, allowing remote attackers to read and modify KeePass database contents via WebSocket connections. It affects KeePassRPC versions before 1.12.0 when used with Kee Vault or similar integrations. Users who have KeePassRPC enabled and exposed to untrusted networks are at risk.
💻 Affected Systems
- KeePassRPC
- Kee Vault
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of KeePass password database, allowing attackers to steal all stored credentials, modify passwords, and potentially gain access to all protected accounts and systems.
Likely Case
Attackers with network access to the KeePassRPC WebSocket interface can extract passwords and modify database contents, leading to credential theft and potential account takeovers.
If Mitigated
With proper network segmentation and KeePassRPC disabled, impact is limited to local attacks requiring physical or malware-based access to the system.
🎯 Exploit Status
Exploitation requires network access to the KeePassRPC WebSocket interface (default port 12546). Public exploit code and detailed analysis are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.12.0 and later
Vendor Advisory: https://forum.kee.pm/t/a-critical-security-update-for-keepassrpc-is-available/3040
Restart Required: Yes
Instructions:
1. Update KeePassRPC plugin to version 1.12.0 or later. 2. Restart KeePass. 3. Verify the plugin version in KeePass Tools → Plugins.
🔧 Temporary Workarounds
Disable KeePassRPC
allCompletely disable the KeePassRPC plugin to eliminate the attack surface
In KeePass: Tools → Plugins → Select KeePassRPC → Disable
Block WebSocket Port
allBlock network access to KeePassRPC WebSocket interface
Windows: netsh advfirewall firewall add rule name="Block KeePassRPC" dir=in action=block protocol=TCP localport=12546
Linux: sudo iptables -A INPUT -p tcp --dport 12546 -j DROP
🧯 If You Can't Patch
- Disable KeePassRPC plugin immediately
- Implement strict network segmentation to isolate systems running vulnerable KeePassRPC versions
🔍 How to Verify
Check if Vulnerable:
Check KeePassRPC plugin version in KeePass: Tools → Plugins → KeePassRPC → Version. If version is below 1.12.0, you are vulnerable.Check Version:
In KeePass: Tools → Plugins → Select KeePassRPC → VersionVerify Fix Applied:
Verify KeePassRPC plugin version is 1.12.0 or higher in KeePass Tools → Plugins.📡 Detection & Monitoring
Log Indicators:
- Unusual WebSocket connections to port 12546
- Multiple failed authentication attempts to KeePassRPC
- Unexpected KeePass database access or modification events
Network Indicators:
- External connections to TCP port 12546
- WebSocket traffic to KeePassRPC endpoint from untrusted sources
- Unusual network patterns to/from systems running KeePass
SIEM Query:
source_port=12546 OR dest_port=12546 OR process_name="KeePass" AND event_type="authentication_failure"