Password for export and change password

[xantoniorx]

I am disappointed because when exporting the database no password is required.
And when I want to change the master password no password is required.

For me it is a bad lack of security because if an attacker who has managed to have access to the PC locally or remotely he can change the password or export the entire database in clear text in a second without any kind of protection. It's rare but it can happen and if it happens game over!

All password managers require the master password to export and change the master password.
I don't understand why KeePass XC doesn't!
That's why I don't use KeePass XC because it's too insecure for it.

I hope you will include this important protection becouse if this problem is not solved it remains a totally useless application to contain passwords.

[oskar2517]

If an attacker has access to your unencrypted database, you have lost anyway. How is that even supposed to work? A website can ask you to confirm a password change by forcing you to enter your current password first but that only works because the user cannot control the backend directly. That's not the case here. The UI is running on the same computer that has been compromised.

There is some fundamental misunderstanding of how local programs work at display here.

[droidmonkey]

Who submitted this? https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-35866

[phoerious]

To anyone reading this: THIS IS NOT A VULNERABILITY.

A local attacker can always do anything to your database. That is by design and simply how things work. KeePassXC is not an online service, so any additional password prompt could be circumvented. Also, there is no reason for an attacker to change your password. If they have access to your unlocked database, they have access to the data in it, no matter what the password is. They also cannot lock you out, unless you fail to do backups.

[phoerious]

I requested a rejection of the CVE with the following reason:

This issue is not a vulnerability. KeePassXC is an offline password manager and hence BY DESIGN, there is no such thing as an "authenticated user". Asking the user for their password prior to making any changes to the database settings adds no additional protection against a local attacker. An attacker can ALWAYS make changes to the database or copy its contents if they get access to it in its unlocked form. A password prompt will not change that. There is also no (and cannot be any) "second factor" for "authentication." Again, this is by design of an offline password manager and not a security problem. This is different from online web services.
A password prompt does not even prevent an attacker from locking a user out of their database. If that were the attacker's goal, they would not need access to the unlocked database. Corrupting the locked KDBX file is enough to achieve this goal. The correct strategy to protect against this is keeping backups of the database. A password prompt will not help.

The premise of the CVE comes from a fundamental misunderstanding of KeePassXC's security model.