OpenSSL Encrypt Information Disclosure via Database Errors

Executive Summary

This vulnerability is an information disclosure flaw in openssl_encrypt versions before 1.4.0. It occurs in the /ready endpoint, which returns full database exception strings to unauthenticated users. Attackers can trigger database errors to extract sensitive details like hostnames, IP addresses, connection parameters, and potentially credentials from these error messages.

Useful 0 Not Useful 0

Detection Guidance

Check if your openssl_encrypt version is below 1.4.0 by running: openssl_encrypt --version. If vulnerable, test the /ready endpoint by sending a malformed request to trigger a database error and observe if detailed exception messages are returned.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain access to sensitive system information, including database credentials or network details. This could lead to further attacks like unauthorized data access, lateral movement within a network, or credential theft. The impact is high severity due to the potential for data breaches and system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA by exposing sensitive personal or health data through information disclosure. GDPR mandates protection of personal data, while HIPAA requires safeguarding protected health information. A breach could result in legal penalties, fines, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.0 or later immediately. If upgrading is not possible, modify the /ready endpoint to return generic error messages and log detailed exceptions server-side.

Useful 0 Not Useful 0