Vulnerable code sample

import requests
import subprocess
import os

def fetch_and_install_ca_cert_vulnerable(ad_cs_hostname: str):
    """
    This is a representative code example of the vulnerability described
    in CVE-2026-12249, as found in ADSys versions up to v0.16.2.

    The function fetches a CA certificate from an Active Directory
    Certificate Services (AD CS) server and installs it into the
    system-wide trust store.
    """

    # VULNERABILITY: The URL is constructed using plaintext 'http://'.
    # A Man-in-the-Middle attacker can intercept this request.
    url = f"http://{ad_cs_hostname}/certsrv/certnew.cer?ReqID=CACert&Enc=b64"

    cert_install_path = "/usr/local/share/ca-certificates/"
    cert_file_path = os.path.join(cert_install_path, f"{ad_cs_hostname}.crt")

    try:
        # The request to fetch the CA certificate is made over an unencrypted channel.
        # An attacker can intercept this and substitute their own malicious CA certificate.
        response = requests.get(url, timeout=10)
        response.raise_for_status()

        # The system takes the received certificate data, which may be attacker-controlled.
        ca_cert_data = response.content

        # The potentially malicious certificate is written to a file in a location
        # read by the system's trust store update mechanism.
        # This part of the code requires root privileges to execute successfully.
        if not os.path.exists(cert_install_path):
            os.makedirs(cert_install_path, exist_ok=True)
        
        with open(cert_file_path, "wb") as f:
            f.write(ca_cert_data)

        # The system blindly trusts the downloaded certificate and runs
        # 'update-ca-certificates'. This adds the attacker's certificate to the
        # system-wide trust store, resulting in trust store poisoning.
        subprocess.run(["update-ca-certificates"], check=True, capture_output=True)

    except requests.exceptions.RequestException as e:
        # In a real-world scenario, errors would be logged.
        # The vulnerability exists in the successful execution path.
        pass
    except (IOError, subprocess.CalledProcessError) as e:
        # These errors would occur due to permissions or other system issues.
        pass