Description

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-08-27T17:20:59.743Z",
  "pubdate": "2026-08-27T17:20:59.743Z",
  "executiveSummary": "The openssl_encrypt utility is susceptible to a terminal injection vulnerability due to insufficient sanitization of file metadata. This flaw allows attackers to embed malicious ANSI escape sequences within file metadata fields, which are subsequently rendered by the info command.\nThe vulnerability type is classified as an improper neutralization of special elements in output (Terminal Injection/Control Character Injection). By crafting a malicious file, an attacker can manipulate the terminal interface to misrepresent data, spoof verification outputs, or trick users into performing insecure actions.\nAffected systems include versions of openssl_encrypt prior to 1.4.9. The risk implication is significant as it compromises the integrity of the information displayed to the end-user, potentially leading to social engineering or the obfuscation of malicious file attributes.\nExploitation requires the victim to execute the info command on a file under the attacker's control. No specialized privileges or network access are required for the exploit itself, as the attack vector is file-based and relies on the terminal emulator's interpretation of control characters.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of input validation and output encoding within the openssl_encrypt info command. When processing file metadata, the application reads embedded strings directly from the file structure and passes them to the standard output (stdout) stream without stripping or escaping terminal control characters.\nThe vulnerable component is the terminal output formatting logic within the info command functionality. Because terminal emulators interpret certain non-printable character sequences—specifically ANSI escape codes—as instructions for cursor positioning, text color, or screen clearing, an attacker can manipulate the terminal state.\nThe attack flow follows a specific sequence: First, the attacker crafts a malicious file containing crafted metadata strings. These strings are injected with terminal control sequences, such as ESC (\\x1b) followed by bracketed commands. Second, the attacker distributes this file to the target user. Third, the victim executes the info command against the malicious file. Finally, the openssl_encrypt utility parses the metadata and writes it to the terminal.\nUpon receiving the un-sanitized output, the terminal emulator processes the injected escape sequences. This allows the attacker to 'repaint' the terminal screen, hiding legitimate metadata or overwriting it with forged verification information. For example, an attacker could clear the existing output and print a fabricated 'Verification Successful' message, even if the file is corrupt or malicious, thereby deceiving the user regarding the file's security status.\nThis vulnerability affects all versions of openssl_encrypt before 1.4.9. Exploitation does not require authentication or elevated privileges, as it is a local client-side interaction. The post-exploitation impact primarily concerns the integrity of the user's view; while it does not directly facilitate remote code execution, it creates a powerful vector for social engineering, where users are manipulated into trusting files based on the forged output displayed in their terminal environment."
}