Description

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticated ciphertext and bypass integrity protection on encrypted data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-17T11:16:43.960Z",
  "pubdate": "2026-08-17T11:16:43.960Z",
  "executiveSummary": "An authentication bypass vulnerability exists in openssl_encrypt versions prior to 1.4.0 within the CamelliaCipher component. The vulnerability stems from insecure environment variable checking, specifically the unintended disabling of HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment variable is detected in the runtime environment.\nThe primary impact of this security flaw is the complete degradation of cryptographic integrity protection for encrypted data payloads. Threat actors possessing prior code execution capabilities within the execution context can leverage this behavior to deliberately suppress cryptographic message authentication codes (MACs). By setting the designated test environment variable, malicious entities can force the cipher implementation to produce unauthenticated ciphertext, rendering subsequent integrity checks ineffective.\nThis vulnerability directly affects openssl_encrypt versions prior to 1.4.0 utilizing CamelliaCipher. The primary risk implication is the potential for ciphertext manipulation, data tampering, and potential chosen-ciphertext attacks due to the absence of enforced message authentication.\nSuccessful exploitation requires the attacker to already possess code execution capabilities sufficient to modify process environment variables before cryptographic operations occur. The vulnerability is entirely dependent on the presence of the testing environment flag during runtime execution, making strict environment sanitization critical for operational security.",
  "technicalDetails": "The vulnerability resides within the CamelliaCipher component of openssl_encrypt in versions prior to 1.4.0. The root cause is the inclusion of a conditional logic check that evaluates the presence of the PYTEST_CURRENT_TEST environment variable during cryptographic initialization and encryption execution routines. Designed presumably for automated testing frameworks, this conditional branch alters the expected cryptographic pipeline by conditionally omitting the generation and verification of Hash-based Message Authentication Codes (HMAC).\nDuring standard operation, the cipher ensures both confidentiality and integrity by pairing symmetric encryption with an authenticated encryption mode or a separate HMAC verification step. However, when the PYTEST_CURRENT_TEST environment variable is populated in the process space, the vulnerable component bypasses the HMAC generation phase. Consequently, the encryption routine outputs ciphertext devoid of integrity metadata, and the decryption routine skips validation tags entirely.\nThe attack flow proceeds as follows: First, an attacker achieves local or remote code execution within the application context, allowing them to manipulate the execution environment. Second, the attacker sets the PYTEST_CURRENT_TEST environment variable prior to triggering the encryption or decryption functionality within openssl_encrypt. Third, when the application invokes CamelliaCipher, the conditional check evaluates to true due to the presence of the environment variable. Fourth, the cryptographic engine disables HMAC tag generation or verification. Fifth, the attacker interacts with the unauthenticated ciphertext, enabling them to alter the encrypted payload without detection by the integrity verification mechanism.\nPrivilege requirements for exploitation dictate that the attacker must have pre-existing code execution privileges to inject or modify environment variables in the targeted application's runtime space. Network exposure is indirect, relying entirely on whether the vulnerable application processes untrusted input using the compromised encryption routine. Post-exploitation impact includes unauthorized data tampering, potential padding oracle side-effects, and the degradation of end-to-end data integrity guarantees."
}