CVE-2022-25577

Vulnerability

ALF-BanCO versions 8.2.5 and below, including the Profi edition, use a hardcoded password to encrypt the local SQLite database (HbDat001.alfdb8) that stores user transactions and account data. The database file is located at C:\Users\\AppData\Roaming\ALFBanCo8\Daten. The hardcoded credential is embedded in the AlfNetDB.dll library and is used by the OpenSQLite function when the bSQLCrypt flag is true. The vulnerability exists in all versions up to and including 8.2.5 [1].

Exploitation

An attacker who gains physical access to the user's machine or remote access (e.g., via malware or an adjacent network position) can locate the encrypted SQLite database file. Using the hardcoded password—disclosed in part by the vendor but recoverable through decompilation of the application's DLLs—the attacker can decrypt and open the database with any SQLite client (e.g., DB Browser for SQLite). The proof-of-concept demonstrates that no elevated privileges beyond local file access are required to extract the credential and access the data [1].

Impact

Successful exploitation allows an attacker to read all data stored in the local database, which includes transaction history, account details, and other personal financial information. The attacker can also modify the database contents, potentially inserting fraudulent records or corrupting the user's bookkeeping. This constitutes a breach of confidentiality and integrity, with the attacker gaining full read/write access to the sensitive data [1].

Mitigation

The vendor has released a patched version 8.3.0 that removes the hardcoded password. Users should upgrade to ALF-BanCO 8.3.0 or later. No official workaround is available for versions 8.2.5 and earlier. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog [1].