Vulnerable code sample

#
# This code demonstrates the logic flaw in rfc3161-client < 1.0.6
# which leads to the Authorization Bypass vulnerability CVE-2026-33753.
#
# The vulnerability exists because the library first finds the correct
# signing certificate to validate the cryptographic signature, but then,
# for authorization checks (like matching a Common Name), it re-iterates
# over the entire bag of certificates and stops at the *first* one that
# matches the authorization criteria.
#
# An attacker can exploit this by adding a forged certificate that meets the
# authorization criteria (e.g., correct Common Name and EKU) to the beginning
# of the certificate list in a validly signed timestamp response.
#
# This example uses mock objects to simulate the behavior without requiring
# cryptographic libraries or real certificates, focusing purely on the flawed logic.
#

# -- Mock objects to simulate the `cryptography` library's data structures --

class MockOID:
    """Mocks a cryptography.x509.ObjectIdentifier."""
    def __init__(self, name):
        self._name = name

class NameOID:
    """Mocks cryptography.x509.oid.NameOID."""
    COMMON_NAME = MockOID("commonName")

class ExtendedKeyUsageOID:
    """Mocks cryptography.x509.oid.ExtendedKeyUsageOID."""
    TIME_STAMPING = MockOID("timeStamping")

class MockNameAttribute:
    """Mocks a cryptography.x509.NameAttribute."""
    def __init__(self, oid, value):
        self.oid = oid
        self.value = value

class MockName:
    """Mocks a cryptography.x509.Name."""
    def __init__(self, attributes):
        self._attributes = attributes

    def get_attributes_for_oid(self, oid):
        return [attr for attr in self._attributes if attr.oid._name == oid._name]

    def __eq__(self, other):
        # Simplified equality for demonstration purposes.
        return str(self) == str(other)

    def __str__(self):
        return ",".join(f"{attr.oid._name}={attr.value}" for attr in self._attributes)

class MockEKU:
    """Mocks a cryptography.x509.ExtendedKeyUsage extension."""
    def __init__(self, oids):
        self.oids = oids

    def __contains__(self, oid):
        return oid in self.oids

class MockExtensions:
    """Mocks a cryptography.x509.Extensions object."""
    def __init__(self, eku=None):
        self.eku = eku

    def get_extension_for_oid(self, oid):
        if oid._name == "EXTENDED_KEY_USAGE" and self.eku:
            return self.eku
        # In real code, this would be ExtensionNotFound.
        raise ValueError("Extension not found")

class MockCertificate:
    """Mocks a cryptography.x509.Certificate."""
    def __init__(self, subject_cn, issuer_cn, serial, has_tsa_eku):
        self.serial_number = serial
        self.subject = MockName([MockNameAttribute(NameOID.COMMON_NAME, subject_cn)])
        self.issuer = MockName([MockNameAttribute(NameOID.COMMON_NAME, issuer_cn)])

        eku_oids = []
        if has_tsa_eku:
            eku_oids.append(ExtendedKeyUsageOID.TIME_STAMPING)
        self.extensions = MockExtensions(eku=MockEKU(eku_oids))

    def dump(self):
        # This is used in the original code to get bytes. We return self for simplicity.
        return self

# -- Custom Exception to mirror the library's behavior --

class VerificationError(Exception):
    pass

# -- The vulnerable verification function --

def vulnerable_rfc3161_verify(p7_certificates, tst_info, common_name=None):
    """
    This function represents the vulnerable logic from rfc3161-client < 1.0.6.
    """
    leaf_certificate = None

    # Step 1: Find the actual signing certificate by matching issuer and serial.
    # This part of the logic is correct and successfully finds the legitimate TSA cert.
    for cert_data in p7_certificates:
        # In the real code, this would parse DER data. We use the mock object directly.
        certificate = cert_data
        if (
            certificate.issuer == tst_info["signer_info"]["issuer"]
            and certificate.serial_number == tst_info["signer_info"]["serial"]
        ):
            leaf_certificate = certificate
            break

    if not leaf_certificate:
        raise VerificationError("Signer certificate not found in PKCS#7 container.")

    # Step 2: The cryptographic signature would be verified here using `leaf_certificate`.
    # We assume this check passes, as the attacker used a response from a real TSA.
    # print(f"Signature validated against: {leaf_certificate.subject}")

    # Step 3: Perform authorization checks. THIS IS THE VULNERABLE PART.
    if common_name:
        cn_found = False
        # The loop re-iterates over the *entire* unordered bag of certs.
        for cert_data in p7_certificates:
            certificate = cert_data
            try:
                # Does the CN match the one we're pinning to?
                cn = certificate.subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value
                if cn == common_name:
                    # Check for Extended Key Usage (EKU) for Time Stamping.
                    ext = certificate.extensions.get_extension_for_oid(MockOID("EXTENDED_KEY_USAGE"))
                    if ExtendedKeyUsageOID.TIME_STAMPING in ext.oids:
                        # Authorization checks passed against this certificate.
                        cn_found = True
                        # FLAW: It stops after the first match, which is the attacker's cert.
                        break
            except Exception:
                # Ignore parsing errors and continue to the next cert.
                pass

        if not cn_found:
            raise VerificationError(
                f"Authorization failed: No certificate found matching CN='{common_name}' with correct EKU."
            )

    # If we reach here, the verification succeeded, but it was flawed.
    return True

# -- Main demonstration of the exploit --

if __name__ == "__main__":
    print("### DEMONSTRATING CVE-2026-33753 VULNERABILITY ###\n")

    # The victim application is configured to trust/pin this specific Common Name.
    PINNED_TSA_CN = "Trusted Corp TSA"

    # 1. A legitimate TSA certificate. Its CN does *not* match the pinned CN.
    legit_tsa_cert = MockCertificate(
        subject_cn="FreeTSA.example.com",
        issuer_cn="Some CA",
        serial=123456789,
        has_tsa_eku=True,
    )

    # 2. An attacker creates a spoofed certificate.
    # It has the CN and EKU the victim application is expecting.
    attacker_cert = MockCertificate(
        subject_cn=PINNED_TSA_CN,  # Matches the pinned CN
        issuer_cn="Attacker",      # Self-signed
        serial=999,
        has_tsa_eku=True,          # Has the required EKU
    )

    # 3. The timestamp token correctly identifies the legitimate TSA as the signer.
    tst_info = {
        "signer_info": {
            "issuer": legit_tsa_cert.issuer,
            "serial": legit_tsa_cert.serial_number,
        }
    }

    # 4. The attacker constructs the malicious PKCS#7 certificate bag.
    # CRITICAL: The attacker's certificate is placed *before* the legitimate one.
    malicious_p7_certificates = [attacker_cert, legit_tsa_cert]

    print(f"Victim application is pinning to TSA with CN: '{PINNED_TSA_CN}'")
    print("A malicious response is received with a certificate bag containing (in order):")
    print(f"  1. Attacker's Certificate (CN='{attacker_cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value}')")
    print(f"  2. Legitimate TSA's Certificate (CN='{legit_tsa_cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value}')\n")
    print("--- Calling vulnerable verification logic ---\n")

    # 5. The victim's application uses the vulnerable library to verify.
    try:
        vulnerable_rfc3161_verify(
            p7_certificates=malicious_p7_certificates,
            tst_info=tst_info,
            common_name=PINNED_TSA_CN,
        )
        print("[!!!] VULNERABILITY EXPLOITED [!!!]")
        print("Result: Verification SUCCEEDED.")
        print("\nExplanation:")
        print("The authorization check (CN and EKU) was performed on the attacker's certificate.")
        print("The cryptographic signature check was performed on the legitimate TSA's certificate.")
        print("The TSA pinning was successfully bypassed.")

    except VerificationError as e:
        print(f"[SAFE] Verification correctly failed: {e}")
        print("The vulnerability could not be demonstrated with the current setup.")