Executive brief
KeePass is a popular open-source password manager used to securely store and manage credentials. A vulnerability in its automatic update feature allows an attacker on the same network (such as a public Wi-Fi) to intercept the update check and trick the software into displaying a fake update notification. If a user follows the prompts, they could be redirected to download and execute malicious software, potentially leading to a full compromise of their computer and stored passwords.
Technical details
KeePass versions 2.33 and earlier perform automatic update checks over unencrypted HTTP by requesting a version file from keepass.info. Because the communication is not encrypted or digitally signed, a man-in-the-middle (MitM) attacker can intercept the request and return a spoofed version response indicating a higher version number is available. When the user clicks to update, the attacker can further intercept the subsequent HTTP request to redirect the user to a malicious executable. This vulnerability was mitigated in version 2.34 by introducing digital signatures for the update information.
Affected products
- KeePass KeePass 2.33 and earlier
Timeline
- 2016-02-08: disclosed: Privately reported to the developer.
- 2016-06-06: patched: Version 2.34 released with digitally signed update information.
- 2017-01-23: advisory: NVD publication date.