CVE-2023-30367:
mRemoteNG vulnerability analysis and mitigation

Overview

Multi-Remote Next Generation Connection Manager (mRemoteNG) versions <= v1.76.20 and <= 1.77.3-dev contain a vulnerability (CVE-2023-30367) where configuration files are loaded in plain text into memory at application start-up, even before any connection is established. This vulnerability affects the software's ability to securely handle sensitive connection configurations and credentials (Secuvera Advisory, GitHub Issue).

Technical details

The vulnerability is classified as CWE-312 (Cleartext Storage of Sensitive Information) and has a CVSS v3.1 base score of 7.5 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The issue occurs when mRemoteNG loads configuration files into memory after decrypting them, regardless of whether connections are established. This happens at application start-up, making sensitive information accessible through memory dumps (NVD).

Impact

The vulnerability allows attackers to access contents of configuration files in plaintext through memory dumps, potentially compromising user credentials. This bypasses both the connection configuration file encryption and configuration password encryption settings, as the data is already decrypted in memory. Even when passwords remain encrypted in the dumped configuration, they can still be decrypted using the default key 'mR3m' if no custom encryption key was set (GitHub PoC).

Mitigation and workarounds

Until a fix is released, users are advised to use strong (long) configuration password encryption keys, as this would require attackers to bruteforce the encryption key even if they obtain the memory dump. Additionally, application whitelisting should be enforced to prevent malicious execution of memory dumping tools. Users should update to versions newer than v1.77.3.1784-NB once a fix is available (GitHub PoC).

Community reactions

The vulnerability was confirmed by Dimitrij Gorodeckij, one of mRemoteNG's developers, who acknowledged the issue and indicated that a fix was in development. The discovery was made by security researcher Maximilian Barz (GitHub Issue).