CVE-2026-4761 Panorama证书私钥权限配置错误

# PoC: Check if 'Operators' group has read access to private keys in Machine Store # This script requires PowerShell and checks the ACLs of non-root certificate keys. function Test-CertificatePrivateKeyAcl { param ( [string]$StorePath = "Cert:\LocalMachine\My" ) Write-Host "[+] Scanning certificates in $StorePath for weak ACLs..." Get-ChildItem -Path $StorePath | ForEach-Object { $cert = $_ if ($cert.HasPrivateKey) { try { # Attempt to get the unique key container name $rsa = [System.Security.Cryptography.RSACryptoServiceProvider]::new() $rsaParameters = $cert.PrivateKey.ExportParameters($false) # In a real scenario, we would resolve the CspKeyContainerInfo to get the file path # For demonstration, we simulate checking the ACL logic described in the CVE $cspParams = New-Object System.Security.Cryptography.CspParameters(1, $cert.PrivateKey.CspKeyContainerInfo.ProviderName, $cert.PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName) $cspParams.Flags = [System.Security.Cryptography.CspProviderFlags]::UseMachineKeyStore $keyPath = Join-Path $env:ProgramData "Microsoft\Crypto\RSA\MachineKeys\$($cert.PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName)" if (Test-Path $keyPath) { $acl = Get-Acl -Path $keyPath $access = $acl.Access | Where-Object { $_.IdentityReference.Value -eq "BUILTIN\Operators" -and $_.FileSystemRights -match "Read" } if ($access) { Write-Host "[!] VULNERABLE FOUND: Certificate Subject: $($cert.Subject)" -ForegroundColor Red Write-Host " Key Path: $keyPath" Write-Host " Issue: 'BUILTIN\Operators' group has Read access." } } } catch { # Ignore errors for certs without accessible key file paths } } } } Test-CertificatePrivateKeyAcl