Exploitation and defense-in-depth mitigation strategies for the KeePass memory leakage vulnerability (CVE-2023-32784).
To analyse the CVE-2023-32784 vulnerability in KeePass Password Safe (v2.53), demonstrate master password extraction via memory dumping, and engineer robust detection and mitigation controls.
KeePass utilises a custom SecureTextBoxEx for master password input, which generates leftover string fragments in the process's address space for every character typed. By capturing a .DMP file of the running process, these fragments can be stitched together to reconstruct the cleartext password.
While the team collaborated on the exploit and mitigation phases, I specifically engineered the vulnerability design and detection strategy utilising Windows Security Auditing:
Process Creation Auditing (Event ID 4688): Configured Group Policy to log all process executions with full command-line arguments. This successfully captured the exact execution string of the C# exploit tool (keepass_password_dumper.exe KeePass.DMP).
Object Access Auditing (Event IDs 4663 & 4656): Configured file system auditing for KeePass.exe and Database.kdbx. This triggered alerts whenever any attempt was made to access or request handles to the sensitive memory space.
Access Control: Removed the "Debug Programs" privilege from standard users via Local Security Policy to prevent unauthorised memory dump creation at the OS level.
Encryption: Deployed BitLocker Full Disk Encryption utilising XTS-AES 128-bit encryption to protect memory dumps and paging files at rest.
