Public Disclosure of issue 726

[Kvarkas]

The passwords of the connection files are stored as plain text values in the memory of the mRemteNG process, even before a connection is established. This fulfills the requirement of CWE-316 - Cleartext Storage of Sensitive Information in Memory. https://github.com/mRemoteNG/mRemoteNG/issues/726

1. Create a new connection configuration, set hostname, username and password.
2. (Optional) Enable encryption of the configuration file.
3. Restart mRemoteNG
4. Use Task Manager / Processhacker / Procdump or any other tool that can create minidumps of a process to create a minidump.
5. Examine the minidump file and look for the password from step one.

Your Environment

• Version used: 1.77.3 dev
• Windows 11

Reported by Maximilian Barz

[S1lkys]

CVE-2023-30367 has been published:

• https://github.com/S1lkys/CVE-2023-30367-mRemoteNG-password-dumper
• https://www.secuvera.de/advisories/secuvera-SA-2023-01.txt

[Neustradamus]

To follow this ticket.

[felsgaertner]

Hello, as this issue was opened almost one year ago and is marked "high priority", I'd like to ask for the current status.