CVE-2026-57916

Executive Summary

CVE-2026-57916 describes a vulnerability in proCertum SmartSign, an application used for digital signing of documents. The application opens the Certificate Practice Statement (CPS) URI from an X.509 certificate without performing schema validation. An attacker can craft a certificate whose CPS URI points to a local executable file (e.g., file:///C:/malware.exe) or any arbitrary URL. When the victim opens a document signed with that certificate inside SmartSign, the application will execute the referenced file or open the URL, leading to arbitrary code execution or phishing attacks. The issue was addressed in SmartSign version 9.4.3.90. No publicly available exploit code has been observed, but the attack vector is straightforward and requires only a signed document.

The vulnerability does not affect any package ecosystem (NPM, PyPI, Go, Ruby, WordPress), so this section is omitted.

CVSS Breakdown & Threat Level

While a CVSS score of 0.0 is officially assigned, based on the description a reasonable vector might be:

• Attack Vector: Network (the malicious certificate can be delivered over email or web)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must open the document with SmartSign)
• Scope: Unchanged
• Confidentiality Impact: High (arbitrary file execution can exfiltrate data)
• Integrity Impact: High (attacker-controlled code can modify system)
• Availability Impact: High (malware can disrupt operations)

Estimated CVSS 3.1 Score: 7.8 (High)

The threat is significant because the attack does not require any special privileges and can be delivered via phishing.

Deep Dive & Mechanics

The vulnerability lies in the way proCertum SmartSign handles the Certificate Practice Statement (CPS) URI extension in X.509 certificates. Normally, the CPS URI is used to point to a document describing the certificate policy. However, SmartSign does not validate the URI scheme before opening it. When a signed document is opened, the application reads the CPS URI from the embedded certificate and passes it to the operating system's default handler for the URI scheme.

An attacker can create a self-signed certificate (or use a compromised CA) with a CPS URI that uses:

• file:// scheme to reference a local executable (e.g., file:///C:/Users/Public/malware.exe)
• javascript: scheme (if allowed by the OS) to execute code
• http:// or https:// to open a phishing page

The document itself can be any supported format (PDF, XML, etc.) signed with this certificate. Upon opening, SmartSign checks the signature and then blindly opens the CPS URI, triggering execution.

Root Cause: Absence of input validation for the CPS URI field. The application should restrict allowed URI schemes (e.g., only http(s)://) and ideally not open URIs automatically.

Vulnerable vs. Patched Code

No actual code snippet is available from the vendor. However, the patch likely includes:

• Vulnerable behavior: SmartSign calls an OS function like ShellExecute() or open() directly with the CPS URI.
• Patched behavior: The application validates the URI scheme against a whitelist (https, http, possibly ftp) and rejects file://, javascript:, data:, etc. It may also prompt the user before opening any external URI.

Exploitation & Lab Setup

Red Team

Attack Scenario:

1. Prepare Malicious Certificate:

   • Create a self-signed X.509 certificate using tools like OpenSSL.
   • Set the CPS URI extension to file:///C:/Users/Public/payload.exe (the payload is a benign executable in this test).
   • Optionally, set other fields to appear legitimate.

2. Sign a Document:

   • Use proCertum SmartSign (or compatible tool) to sign a PDF or XML document with the malicious certificate.
   • Ensure the CPS URI is embedded in the signature.

3. Deliver to Victim:

   • Send the signed document via email or other means.

4. Execute:

   • When the victim opens the document in SmartSign (version < 9.4.3.90), the application will automatically launch payload.exe.

Proof-of-Concept (Conceptual):

# Generate a self-signed certificate with a CPS URI pointing to notepad.exe
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes \
    -subj "/C=US/ST=CA/L=San Francisco/O=Test/CN=test" \
    -addext "certificatePolicies=1.3.6.1.5.5.7.12.2,URI=file:///C:/Windows/System32/notepad.exe"

Then sign a document using SmartSign with this certificate. (Actual signing process depends on the application.)

Blue Team

Detection & Prevention:

• Network Monitoring: Look for documents with X.509 certificates containing CPS URIs that use non-http schemes.
• Endpoint Controls: Block execution of processes spawned by SmartSign that have suspicious parent-child relationships.
• Application Whitelisting: Restrict which applications can be launched from within SmartSign.
• User Awareness: Train users not to open signed documents from untrusted sources.

Indicators of Compromise (IOCs)

• File Hashes: Any signed document (.pdf, .xml, .p7s) containing a certificate with a CPS URI pointing to a local executable or suspicious URL.
• Network: Outbound connections to unexpected domains if CPS URI uses http:// or https://.
• Process Trees: SmartSign.exe spawning cmd.exe, powershell.exe, or other executables.
• Registry: Possible persistence if the payload installs itself.

Detection Engineering

YARA Rule

rule CVE_2026_57916_CPS_URI_Execution {
    meta:
        description = "Detects signed documents with CPS URI pointing to local file or script"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-57916"
    strings:
        $cps_uri = /certificatePolicies.*URI=(file|javascript|data):/ nocase ascii wide
    condition:
        $cps_uri
}

Sigma Rule

title: ProCertum SmartSign CPS URI Execution
status: experimental
description: Detects attempts to open suspicious CPS URIs via SmartSign
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\\SmartSign.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
    condition: selection
falsepositives:
    - Legitimate documents using http CPS URIs
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2026-57916 Potential CPS URI Outbound"; flow:to_server,established; content:"|0d 0a|"; http_client_body; content:"certificatePolicies"; nocase; pcre:"/URI=(file|javascript|data):/i"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Upgrade proCertum SmartSign to version 9.4.3.90 or later.
• Compensating Controls:
  • Disable automatic URI handling via Group Policy or registry (if possible).
  • Use an endpoint detection and response (EDR) solution to monitor child processes of SmartSign.
  • Implement application control to prevent SmartSign from launching executables.
• Long-term: Vendors should validate all URI inputs and restrict allowed schemes.

Valters IT – Securing Digital Signatures