CVE-2024-33900
📋 TL;DR
CVE-2024-33900 allows an attacker with local system access to recover cleartext KeePassXC credentials via memory dumping techniques. This affects KeePassXC users on systems where an attacker gains local privileges. The vendor disputes this as a vulnerability, stating it's inherent to memory management constraints.
💻 Affected Systems
- KeePassXC
📦 What is this software?
Keepassxc by Keepassxc
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all KeePassXC credentials stored in memory, leading to credential theft and potential lateral movement.
Likely Case
Local attacker with user privileges extracts some credentials from memory, potentially accessing sensitive accounts.
If Mitigated
Minimal impact if proper access controls prevent local privilege escalation and memory dumping tools are restricted.
🎯 Exploit Status
Exploit requires local access and memory dumping tools. Public PoC available in GitHub gist. Not remotely exploitable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None - vendor disputes this as a vulnerability
Vendor Advisory: https://keepassxc.org/blog/2019-02-21-memory-security/
Restart Required: No
Instructions:
No official patch. Vendor considers this inherent to memory management. Consider workarounds or alternative password managers.
🔧 Temporary Workarounds
Minimize KeePassXC runtime
allClose KeePassXC when not actively using it to reduce memory exposure window
Use secure desktop/lock workstation
allAlways lock workstation when stepping away to prevent local access
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized local system access
- Use endpoint protection to detect and prevent memory dumping tools
🔍 How to Verify
Check if Vulnerable:
Check KeePassXC version. If version is 2.7.7 or earlier, system is potentially vulnerable.Check Version:
keepassxc --version (Linux/macOS) or check About in KeePassXC GUI (Windows)Verify Fix Applied:
No official fix available. Consider migrating to alternative password manager with better memory protection.📡 Detection & Monitoring
Log Indicators:
- Process memory dumping tools execution
- Unauthorized access to KeePassXC process memory
Network Indicators:
- None - local attack only
SIEM Query:
Process creation where command_line contains 'procdump', 'mimikatz', or similar memory dumping tools🔗 References
- https://gist.github.com/Fastor01/30c6d89c842feb1865ec2cd2d3806838
- https://github.com/keepassxreboot/keepassxc/issues/10784
- https://keepassxc.org/blog/
- https://keepassxc.org/blog/2019-02-21-memory-security/
- https://gist.github.com/Fastor01/30c6d89c842feb1865ec2cd2d3806838
- https://github.com/keepassxreboot/keepassxc/issues/10784
- https://keepassxc.org/blog/
- https://keepassxc.org/blog/2019-02-21-memory-security/
