mRemoteNG / mRemoteNG/mRemoteNG
Public Disclosure of issue 726
Open
@Kvarkas is already working on this.
Since Apr 3, 2023.
1.77.3
Connections
In progress
Priority - High
Security
Security Vuln
Verified
Windows
- Dominant language
- C#
- Stars
- 11.1k
- Forks
- 1.6k
- Avg merge
- 16h 58m
- Merged PRs (30d)
- 55
Description
The passwords of the connection files are stored as plain text values in the memory of the mRemteNG process, even before a
connection is established.
This fulfills the requirement of CWE-316 - Cleartext Storage of Sensitive
Information in Memory.
https://github.com/mRemoteNG/mRemoteNG/issues/726
- Create a new connection configuration, set hostname, username and
password. - (Optional) Enable encryption of the configuration file.
- Restart mRemoteNG
- Use Task Manager / Processhacker / Procdump or any other tool that can
create minidumps of a process to create a minidump. - Examine the minidump file and look for the password from step one.
Your Environment
- Version used: 1.77.3 dev
- Windows 11
Reported by Maximilian Barz
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.