GRAU DATA Blocky Password Storage Vulnerability Allowing Local User Impersonation

A vulnerability exists in GRAU DATA Blocky versions 2.6.x and 2.7.x on Windows, where passwords are stored encrypted instead of hashed. During login, the encrypted password is decrypted and compared to the user's input. This flaw allows an attacker with Windows admin or debugging rights to steal the user's Blocky password and impersonate them locally.

Impact

Exploitation of this vulnerability could lead to local privilege escalation by allowing an attacker to impersonate another user on the system.

Remediation

Users are advised to update Blocky to version 3.1. Instructions for updating can be found on the Blocky for Veeam website.