SecBoard
Zurück zur CVE-Übersicht

CVE-2026-81707

CRITICAL(9.8)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score25/100 — MITTEL
  • CVSS 9.8 — Kritisch

EPSS-Score

0.4%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.8

Technische Schwere

Beschreibung

openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows or keyserver responses to manipulate terminal output and display a fraudulent fingerprint, bypassing the out-of-band verification mechanism that protects against key substitution attacks.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 1.4.9

Threat-Hunting-Queries

Die Schwachstelle basiert auf der Injektion von ANSI-Escape-Sequenzen in das E-Mail-Feld importierter Identitätsdokumente, um die Fingerprint-Verifikationszeile in der Terminalausgabe zu manipulieren. Eine direkte IOC-basierte Erkennung ist schwierig, da die Angriffsvektoren (Kontakt-Austausch, Keyserver-Antworten) und die Payload (JSON mit Unicode-Escape-Sequenzen) vielfältig sein können. Verhalt

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName == "openssl_encrypt.exe" or InitiatingProcessFileName == "openssl_encrypt.exe"
| where ProcessCommandLine contains "import_public" or ProcessCommandLine contains "identity create"
| where ProcessCommandLine matches regex @"email\s*:\s*['\"]?[^'\"]*\\u001b"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, FolderPath

Splunk SPL

index=your_index_name (sourcetype=your_process_logs OR sourcetype=your_application_logs) (process="openssl_encrypt" OR commandline="*openssl_encrypt*") (commandline="*import_public*" OR commandline="*identity create*") (commandline="*email\s*:\s*['\"]?[^'\"]*\\u001b*")
| table _time, host, user, process, commandline

Sigma

title: openssl_encrypt ANSI Escape Injection Attempt
status: experimental
description: Detects attempts to exploit CVE-2026-81707 by injecting ANSI escape sequences into openssl_encrypt commands.
author: SecBoard Operations
date: 2026/08/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\openssl_encrypt.exe'
    CommandLine|contains:
      - 'import_public'
      - 'identity create'
    CommandLine|contains|all:
      - 'email'
      - '\u001b'
  condition: selection
falsepositives:
  - Legitimate use of openssl_encrypt with unusual email formats (unlikely to contain ANSI escapes).
level: high

Elastic ES|QL

FROM process
| WHERE process.executable.name == "openssl_encrypt.exe" OR process.parent.executable.name == "openssl_encrypt.exe"
| WHERE process.args LIKE "*import_public*" OR process.args LIKE "*identity create*"
| WHERE process.args LIKE "*email*" AND process.args LIKE "*\\u001b*"
| SELECT @timestamp, host.name, process.executable.name, process.command_line, process.args

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen