Path Traversal in OpenSSL Encrypt Plugin

Executive Summary

This vulnerability is a path traversal issue in the openssl_encrypt package versions before 1.4.0. The _is_safe_path method uses an unsanitized plugin_id parameter to construct a plugin config directory path. Attackers can exploit this by including path traversal sequences like '../' in the plugin_id to access directories outside the intended plugin directory.

Useful 0 Not Useful 0

Detection Guidance

Check for vulnerable openssl_encrypt versions before 1.4.0 by inspecting installed packages and plugin configurations. Look for plugin_id parameters containing path traversal sequences like '../' in logs or plugin directories. Review plugin_sandbox.py for unsanitized plugin_id usage.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to read or write files in arbitrary directories on the system where the plugin is installed. This may lead to unauthorized access to sensitive data, modification of critical files, or execution of malicious code depending on the plugin's permissions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.0 or later. Sanitize plugin_id inputs to reject path separators, '..', null bytes, and non-alphanumeric characters. Remove redundant validation checks in plugin_sandbox.py. Monitor for unauthorized directory access attempts.

Useful 0 Not Useful 0