PT-2023-22655 · Mremoteng · Mremoteng

Maximilian Barz · Published 2023-07-26 · Updated 2024-08-15 · CVE-2023-30367

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions mRemoteNG versions <= 1.76.20 mRemoteNG versions <= 1.77.3-dev

Description The issue allows attackers to access the contents of configuration files in plain text through a memory dump, thus compromising user credentials when no custom password encryption key has been set. This occurs because mRemoteNG loads configuration files into memory in plain text at application start-up, even if no connection has been established yet. This behavior bypasses the connection configuration file encryption setting by dumping already decrypted configurations from memory.

Recommendations For mRemoteNG versions <= 1.76.20, consider setting a custom password encryption key to protect user credentials. For mRemoteNG versions <= 1.77.3-dev, consider setting a custom password encryption key to protect user credentials. As a temporary workaround, consider restricting access to sensitive configuration files until a patch is available.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2023-30367

Affected Products

Mremoteng

References · 8

• 🔥 https://github.com/S1lkys/CVE-2023-30367-mRemoteNG-password-dumper · Exploit
• 🔥 https://exploit-db.com/exploits/51637 · Exploit
• 🔥 http://packetstormsecurity.com/files/173829/mRemoteNG-1.77.3.1784-NB-Sensitive-Information-Extraction.html · Exploit
• https://osv.dev/vulnerability/CVE-2023-30367 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30367 · Security Note
• https://github.com/mRemoteNG/mRemoteNG/issues/2420 · Note
• https://secuvera.de/advisories/secuvera-SA-2023-01.txt · Note
• https://twitter.com/_ringbuffer/status/1824155607768686823 · Twitter Post