CVE-2023-35866: 
NixOS vulnerability analysis and mitigation

CVE-2023-35866 affects KeePassXC through version 2.7.5, a popular open-source password manager. The vulnerability allows a local attacker to modify database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session without requiring additional authentication. The issue was discovered in March 2023 and publicly disclosed in June 2023. This vulnerability is currently disputed, as the vendor maintains that requiring password confirmation for database setting changes does not provide additional protection against local attackers (NVD, SecurityOnline).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. The issue stems from the application's design which allows changes to security settings without requiring re-authentication through master password or second-factor authentication in an already authenticated session. The vulnerability affects the database security settings modification functionality, particularly concerning master password changes and second-factor authentication configurations (NVD).

If exploited, this vulnerability could allow an attacker with local access to modify critical security settings of the KeePassXC database, including changing the master password and second-factor authentication settings. This could potentially lead to unauthorized access to all stored passwords and sensitive information within the database. The impact is particularly significant as it could compromise the entire password database without requiring the original master password or second-factor authentication for verification (Medium Blog).

The vulnerability requires local access to an authenticated KeePassXC Database session. An attacker would need access to the system while the database is unlocked to exploit this vulnerability. The attack vector is considered relatively straightforward, requiring low attack complexity and low privileges (NVD).

As of the current version (2.7.5), there are no official fixes available. The vendor has scheduled addressing this issue for version 2.8.0, though no specific release date has been announced. The vendor's position is that requiring password confirmation for database setting changes would not provide additional protection against local attackers (Medium Blog).

The vulnerability was initially reported privately to the KeePassXC Team on March 21, 2023. The team initially considered it a cosmetic GUI feature rather than a security vulnerability. After public disclosure on GitHub (Issue #9391) on May 5, 2023, the issue gained more attention, leading to the assignment of CVE-2023-35866 on June 19, 2023 (Medium Blog).