>an attacker, who has write access to the XML configuration file
If an attacker already has write-access to local files he could also replace keepass.exe or install a keylogger.
If this happens, it's already too late.. this CVE is a joke!
If an attacker already has write-access to local files he could also replace keepass.exe or install a keylogger.
If this happens, it's already too late.. this CVE is a joke!
Another recent example is https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2405... which is for a purely theoretical exploit - not even a PoC - with the only 'sources' being Reddit/Twitter scaremongering, and 'support forum posts' that quote these exact same Twitter threads.
That CVE isn't just a disagreement, it's a warning. Avoid security related software from people who enjoy keeping a security edge over the unwashed masses who aren't in the know, who don't get a kick out of locking down. Because that's why they keep the unsafe defaults, they keep them because they enjoy going the extra mile for their own safety. That is, unless they (also) have worse reasons for keeping unsafe defaults, but, well, Hanlon to the rescue.
Full disclosure, I sell a premium KP2 plugin and would hate for users to have to reinstall KP2 or go through extra hoops to use my plugin.
But:
1. Ease of use is a security concern - if it's a pain in the ass to use a security measure, users won't.
2. There's also attacks that for whatever reason aren't able to achieve persistence, but are able to obtain files. Let's imagine a browser or scp or rsync or whatever exploit that tricks it into uploading unintended files. These cases will be blocked by KeePass but not by your .csv
3. Users want to sync their password database via untrusted means (e.g. cloud providers). This is easier when the database is itself encrypted. (This attack targets the application config, not the database config, which is a strange choice to sync).
What threats did you think keepass was defending against exactly?
Similar, a virus-scanner will look intensively at exe-files and access to keyboard-input, but not so much at some random configuration, which is supposed to change all the time anyway.