Description

openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide offline password guessing at hardware speed to recover user passwords.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T17:20:58.697Z",
  "pubdate": "2026-08-27T17:20:58.697Z",
  "executiveSummary": "A critical vulnerability exists in openssl_encrypt versions prior to 1.4.9 involving insecure key derivation mechanisms for the remote-pepper wrap key.\nThe implementation utilizes either unsalted HKDF-SHA256 or bare SHA-256 for password-based key derivation, effectively omitting a unique salt during the transformation process.\nThis design failure results in the derivation of identical keys across multiple users and protected files, fundamentally undermining the cryptographic uniqueness required for secure data wrapping.\nThe risk implication is severe: an attacker possessing intercepted or accessed wrapped pepper blobs can conduct offline brute-force or dictionary-based password cracking at hardware-accelerated speeds.\nBy precomputing a single global lookup table, an adversary can compromise a vast fleet of user credentials simultaneously without needing to target individual users iteratively.\nThe vulnerability requires the attacker to obtain the wrapped pepper blobs, which can be accomplished through network interception, database exfiltration, or local file access depending on the architectural deployment.\nSuccessful exploitation allows for mass password recovery, leading to full unauthorized access to encrypted user data and potential lateral movement within the system.",
  "technicalDetails": "The vulnerability resides within the key derivation function (KDF) logic of openssl_encrypt prior to version 1.4.9. The implementation fails to incorporate a cryptographically strong salt, relying instead on unsalted HKDF-SHA256 or a direct, deterministic SHA-256 hash of the user's password.\nIn standard cryptographic practices, salt is used to ensure that the same password generates a unique key (or derived hash) for different users or sessions, thereby mitigating the efficacy of rainbow tables and precomputed dictionary attacks. By omitting the salt, the output key becomes purely a function of the input password.\nThe root cause is the lack of domain separation and uniqueness in the key derivation process. Because the KDF output is identical for identical passwords regardless of the user identity, the encryption primitive effectively uses the same master key or wrapping key across the entire application footprint.\nThe exploitation flow proceeds as follows: 1. The attacker acquires the wrapped pepper blobs, which are stored assets protected by the insecure key. 2. Since the derivation mechanism is static and unsalted, the attacker constructs a dictionary or lookup table of common password hashes derived via the identified primitive (SHA-256 or HKDF-SHA256 without salt). 3. The attacker matches the stolen blobs against this precomputed table. 4. Because the derived key is the same for every instance where the password is the same, the attacker can verify passwords fleet-wide.\nThis methodology transforms the recovery effort from an expensive, per-target operation into a singular, highly efficient offline computation. The attacker performs these actions in their own infrastructure, circumventing account lockout policies, rate limiting, or logging mechanisms that would typically prevent online brute-force attempts.\nThe scope of impact includes all systems utilizing the affected versions for managing remote-pepper wrap keys. Given that SHA-256 is inherently fast and the lack of salt allows for massive parallelism on GPUs or FPGAs, the password entropy is significantly reduced in practice, making even complex passwords susceptible to high-speed recovery tactics.\nThe vulnerability is inherent to the logic of the affected component, requiring no authentication or specific privileges beyond the ability to access the encrypted blobs. Once the password is recovered, the attacker gains the ability to unwrap the pepper and decrypt associated user data, resulting in a total compromise of the cryptographic perimeter."
}