OpenSSL sandbox escape via restricted exec() in IsolatedPluginExecutor

Executive Summary

This is a sandbox escape vulnerability in openssl_encrypt versions before 1.4.0. It occurs in IsolatedPluginExecutor where Python type objects are exposed in restricted exec() builtins. Attackers can traverse the class hierarchy using __class__.__mro__.__subclasses__() to access system functions and execute arbitrary OS commands.

Useful 0 Not Useful 0

Detection Guidance

Check if openssl_encrypt versions before 1.4.0 are installed using pip list or pip show openssl_encrypt. Inspect plugin_sandbox.py for IsolatedPluginExecutor usage with exec() and restricted __builtins__. Look for suspicious plugin activity or unexpected system command execution.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to bypass sandbox restrictions and execute arbitrary OS commands. This could lead to full system compromise, including filesystem access, process spawning, and network connections if a malicious plugin is used.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows arbitrary OS command execution, which could lead to unauthorized data access, modification, or exfiltration. For GDPR, this could result in violations of data integrity and confidentiality. For HIPAA, it may compromise protected health information integrity and availability.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.0 or later immediately. Avoid using exec() for sandboxing in plugins. Implement OS-level restrictions like seccomp or containers. Review and restrict plugin permissions thoroughly.

Useful 0 Not Useful 0