Description

openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control bytes that repaint a forged PASSED verdict on screen, masking actual tamper detection. Fixed in 1.4.9 by routing drive-derived names through sanitize_for_display().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-08-27T17:20:59.447Z",
  "pubdate": "2026-08-27T17:20:59.447Z",
  "executiveSummary": "The openssl-encrypt pip package versions 1.4.8 and earlier contain a terminal injection vulnerability within the verify-usb command. This vulnerability stems from improper sanitization of filenames read from external storage devices before they are rendered to the terminal output.\nBy crafting malicious filenames containing ANSI escape sequences—specifically those capable of cursor manipulation and line erasure—an attacker can manipulate the terminal's display. This allows the attacker to obscure legitimate error messages or tamper detection alerts, effectively overwriting terminal output to present a fraudulent 'PASSED' verification status to the user.\nThis vulnerability primarily affects users who rely on the verify-usb command to assess the integrity of untrusted hardware. The risk is significant as it provides a mechanism for attackers to bypass visual integrity verification processes. The vulnerability does not require authentication or elevated privileges, provided the attacker can influence the filesystem structure on the target USB device. The impact is limited to the local terminal environment, facilitating social engineering or technical deception rather than direct code execution.",
  "technicalDetails": "The vulnerability resides in the verify-usb command's handling of metadata derived from external drives. Specifically, the software reads filenames from untrusted drive data that exists outside the AES-GCM authenticated manifest. Because these filenames are treated as trusted strings, they are passed directly to standard output without sanitization.\nThe root cause is the failure to filter non-printable and control characters, particularly those interpreted by terminal emulators as ANSI escape sequences. An attacker can create a file on a USB device with a name containing sequences such as '\\033[A' (cursor up) or '\\033[2K' (erase line). When the verify-usb tool lists these files during its verification process, the terminal emulator processes these sequences in real-time.\nThe attack flow follows a structured exploitation path: First, the attacker creates a directory or file structure on a USB device where the directory names or filenames incorporate malicious ANSI sequences. Second, the victim executes the verify-usb command on the compromised device. Third, as the tool processes the filesystem, it outputs the attacker-controlled names to the console. Fourth, the injected escape sequences trigger terminal operations that reposition the cursor or clear the current line. By carefully timing these operations, the attacker can effectively 'repaint' the terminal screen. If the tool displays a failure message regarding tampered files, the injected sequences can erase that line and print a simulated 'PASSED' verdict in its place, masking the actual detection of the tampering.\nThis vulnerability is an input validation issue concerning how the application interacts with the terminal environment. It affects versions 1.4.8 and older. As the input is derived from physical hardware (USB drives), there is no requirement for network connectivity or remote authentication. The attack is strictly local and relies on the user performing the verification task, making it a critical threat to trust in the verification utility. The exploitation does not result in memory corruption or remote code execution, but it succeeds in undermining the fundamental purpose of the software: ensuring security and integrity through visual feedback."
}