Description

openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T17:21:00.070Z",
  "pubdate": "2026-08-27T17:21:00.070Z",
  "executiveSummary": "The openssl_encrypt utility, in versions prior to 1.4.9, is susceptible to a command injection vulnerability stemming from improper input sanitization within the info command interface.\nThis vulnerability is classified as a shell injection flaw, arising when untrusted metadata fields are interpolated into a command-line string without adequate quoting or escaping mechanisms.\nThe primary impact involves the potential for arbitrary command execution on a user's system.\nThe attack vector is characterized by a social engineering component, where an attacker crafts malicious metadata—such as a pepper_name field containing shell metacharacters—which is subsequently embedded into a reconstructed CLI block.\nWhen a legitimate user copies and executes this block within a shell environment, the injected malicious instructions are interpreted and executed with the privileges of the user.\nThe risk implication is critical, as it bypasses intended functional constraints to facilitate unauthorized code execution. Exploitation requires the attacker to influence the metadata processed by the utility and relies on the user performing a manual action—copying and pasting the suggested CLI command into their local shell environment.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure construction of command-line strings within the info command functionality of openssl_encrypt. The application logic fails to properly sanitize or quote untrusted metadata fields before interpolating them into a template string intended for shell execution.\nThe vulnerable component is the routine responsible for generating the CLI block output, specifically where variable metadata fields like pepper_name are concatenated into an executable script format.\nAffected versions are strictly identified as all releases preceding version 1.4.9.\nExploitation follows a predictable flow: first, an attacker supplies malicious input via an available metadata field; second, the openssl_encrypt utility processes this metadata and generates a CLI block that includes the unquoted input; third, the output is displayed to the user as a suggested operational command; fourth, the user, acting as a victim, copies this output and executes it within a terminal or command shell.\nBecause the input is not sanitized, the attacker can inject shell-specific metacharacters (e.g., backticks, semi-colons, or pipe symbols) that terminate the intended command and initiate a secondary, arbitrary command payload.\nFor example, if the pepper_name field is set to 'value; rm -rf /; echo', the resulting CLI block will contain these characters literally. When passed to a shell, the shell parser interprets the semicolon as a command delimiter, executing the legitimate openssl_encrypt command followed immediately by the attacker's malicious payload.\nThis vulnerability does not require remote authentication or elevated system privileges to initiate; however, the successful execution of the payload is contingent upon the user executing the provided output in a shell environment. The network exposure is limited by the context in which the metadata is provided and displayed. The post-exploitation impact is limited only by the permissions of the user executing the command, potentially leading to unauthorized data exfiltration, system modification, or persistent access if the victim executes the command with administrative privileges."
}