Authentication Bypass in OpenSSL Encrypt Verify API Token

Executive Summary

This vulnerability is an authentication bypass in openssl_encrypt versions before 1.4.0. The verify_api_token function accepts any non-empty Bearer token without validation, allowing attackers to bypass authentication by providing arbitrary tokens in the Authorization header. This enables unauthorized actions like uploading malicious public keys, enumerating all keys, and revoking keys belonging to other users.

Useful 0 Not Useful 0

Detection Guidance

Check if your openssl_encrypt version is before 1.4.0 by running: openssl_encrypt --version. Inspect API endpoints handling Bearer tokens for improper validation in the verify_api_token function. Monitor for unauthorized key uploads, key enumeration, or key revocations in logs.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to bypass authentication and perform unauthorized actions such as uploading malicious public keys, enumerating all existing keys, or revoking keys belonging to any user. This could lead to data breaches, unauthorized access, or denial of service if keys are revoked.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to openssl_encrypt version 1.4.0 or later if available. If not, apply the patch from commit 1d519a1. Disable the standalone key server if not required. Implement strict Bearer token validation in verify_api_token function.

Useful 0 Not Useful 0