Cross-Origin Request Forgery in OpenSSL Encrypt

Executive Summary

This vulnerability affects openssl_encrypt versions before 1.4.0 due to improper CORS configuration. The software sets allow_origins to wildcard (*) and enables allow_credentials, allowing any website to make authenticated cross-origin requests to the API on behalf of users who visit malicious sites.

Useful 0 Not Useful 0

Detection Guidance

Check CORS configuration in your openssl_encrypt application by inspecting environment variables and code for settings like allow_origins=[*], allow_credentials=True, allow_methods=[*], and allow_headers=[*]. Review .env files, docker-compose.yml, and app/main.py for wildcard defaults.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to perform actions on your behalf if you visit their malicious website. This could lead to unauthorized data access, account manipulation, or other malicious activities depending on the API's functionality.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate data protection regulations like GDPR and HIPAA by enabling unauthorized cross-origin data access. It compromises user consent and data integrity, potentially leading to non-compliance with privacy and security requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Update openssl_encrypt to version 1.4.0 or later. Remove wildcard defaults for CORS origins and avoid combining allow_origins=[*] with allow_credentials=True. Replace * with specific trusted domains in .env.example and configuration files.

Useful 0 Not Useful 0