Description

openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T17:20:58.553Z",
  "pubdate": "2026-08-27T17:20:58.553Z",
  "executiveSummary": "A cryptographic design flaw exists in versions of openssl_encrypt prior to 1.4.9, involving the improper storage of plaintext-derived metadata within encrypted file headers.\nThe vulnerability involves the inclusion of an unkeyed SHA-256 hash of the original plaintext in the cleartext portion of the file header.\nThis metadata exposure allows unauthorized actors to perform side-channel analysis without requiring the decryption key or knowledge of the passphrase.\nThe primary risk implications include plaintext confirmation via offline dictionary or brute-force attacks and cross-file pattern matching.\nAn attacker does not require elevated privileges or authentication to access the file, as the hash is embedded in the publicly readable header metadata.\nThe vulnerability effectively breaks the confidentiality of the plaintext under specific conditions, as identical plaintexts can be fingerprinted across disparate encrypted files, leading to data leakage through traffic or file analysis.",
  "technicalDetails": "The root cause of this vulnerability is a fundamental failure in the implementation of the file format specification used by openssl_encrypt prior to version 1.4.9. The library calculates a SHA-256 cryptographic hash of the plaintext material and embeds this result directly into the file header without an accompanying Message Authentication Code (MAC) or encryption of the metadata field itself.\nBecause the hash is unkeyed—lacking an HMAC construction or salt—it functions as a deterministic fingerprint of the plaintext input. The attack flow is straightforward: an attacker gains access to the encrypted file and parses the header to extract the SHA-256 hash. Given the deterministic nature of SHA-256, if the attacker suspects a specific plaintext, they can precompute the hash of that candidate plaintext. By comparing the calculated hash against the value extracted from the header, the attacker can verify the plaintext with absolute certainty without ever needing to perform the expensive or impossible task of decryption.\nFurthermore, this vulnerability facilitates cross-file correlation. Even if the attacker does not know the content of the file, they can identify identical plaintext contents across multiple files encrypted by different users or keys. This fingerprinting allows for the clustering of sensitive data and the mapping of encrypted structures within an environment.\nThe vulnerability resides in the header generation and parsing logic of the openssl_encrypt component. Since the metadata is written to the file in the clear, the exposure is persistent. Exploitation does not require network exposure or interaction with the system performing the encryption; it only requires access to the resulting encrypted file. There are no authentication or privilege requirements to read the header metadata. The post-exploitation impact is a direct breach of privacy and confidentiality, specifically enabling plaintext recovery through brute-force/dictionary attacks on the hash rather than the actual encryption algorithm, and facilitating traffic analysis or data correlation across separate encrypted storage segments."
}