openssl-encrypt mTLS Private Key Exposure via SharedPreferences

Executive Summary

This vulnerability affects the openssl_encrypt package versions 1.4.8 and earlier. It involves storing an mTLS client private key in plaintext within a world-readable SharedPreferences file (permissions 0644) via the desktop GUI's Settings screen. A local attacker with file system access can read the exposed private key.

Useful 0 Not Useful 0

Detection Guidance

Check for world-readable SharedPreferences files (0644 permissions) containing mTLS client private keys in plaintext. Look for files named SharedPreferences in the application's data directory. Use commands like 'find / -type f -perm 0644 -exec grep -l "PRIVATE KEY" {} \;' to search for files with private keys.

Useful 0 Not Useful 0

Impact Analysis

An attacker with local file system access could steal the private key, enabling unauthorized access to mTLS-protected services or impersonation of the client. This could lead to data breaches, unauthorized system access, or further attacks within the network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for protecting sensitive data such as private keys. GDPR and HIPAA mandate safeguarding personal and health information, and storing private keys in plaintext could result in non-compliance, potential fines, and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to openssl-encrypt version 1.4.9 or later. Verify that private keys are stored in a dedicated file with 0600 permissions and only the file path is kept in SharedPreferences. Remove any existing plaintext private keys from SharedPreferences files.

Useful 0 Not Useful 0