Description

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T11:16:42.460Z",
  "pubdate": "2026-08-17T11:16:42.460Z",
  "executiveSummary": "An information disclosure vulnerability has been identified in openssl_encrypt versions prior to 1.4.0. The vulnerability resides within the /ready endpoint, which improperly handles internal application states and returns verbose database exception strings directly to unauthenticated callers.\nThe primary impact of this flaw is the unauthorized exposure of sensitive internal infrastructure metadata, including database connection parameters, internal hostnames, IP addresses, and potentially credentials embedded within the exception messages.\nThe affected product is openssl_encrypt, specifically all versions prior to 1.4.0. The risk implications are severe, as exposed configuration and connectivity details significantly lower the barrier for subsequent, targeted attacks against the underlying database and host infrastructure.\nAttackers do not require authentication, prior system access, or specialized privileges to exploit this vulnerability. Exploitation merely requires sending malicious or malformed input to the /ready endpoint designed to trigger a database error, thereby forcing the application to leak sensitive exception diagnostics in the HTTP response.",
  "technicalDetails": "The root cause of the vulnerability stems from improper error handling and exception management within the application logic exposed by the /ready endpoint in openssl_encrypt versions prior to 1.4.0. When the endpoint encounters database-related operational failures or processing anomalies, it fails to sanitize or abstract the resulting exception messages before rendering them to the client.\nThe vulnerable component is the database error handling mechanism tied to the /ready endpoint web handler. Network exposure is external, as the endpoint is accessible over the network to unauthenticated callers without requiring any pre-existing session, user credentials, or administrative privileges.\nThe step-by-step attack flow proceeds as follows. First, an unauthenticated attacker identifies the target application running an affected version of openssl_encrypt and locates the /ready endpoint. Second, the attacker sends specially crafted HTTP requests designed to intentionally induce database exceptions, such as syntax violations, connection timeouts, or constraint failures.\nThird, the database layer throws an exception containing detailed diagnostic information, including underlying database drivers, database server hostnames, internal IP addresses, active connection strings, authentication parameters, and potential credential hashes.\nFourth, the application catches the exception and improperly returns the raw, unmasked exception string within the HTTP response body back to the unauthenticated caller. Finally, the attacker parses the response to harvest sensitive configuration data.\nThe post-exploitation impact includes the aggregation of critical internal network topology and credential data. Attackers can leverage the extracted hostnames, IP addresses, and connection strings to mount direct pivot attacks against internal database services, bypass perimeter controls, or perform credential stuffing and brute-force attacks against related administrative interfaces."
}