Full Report
CERT Polska has received a report about 2 vulnerabilities (CVE-2026-57916 and CVE-2026-57917) found in proCertum SmartSign software.
Analysis Summary
# Vulnerability: Multiple Flaws in proCertum SmartSign (Arbitrary Execution and XXE)
## CVE Details
- **CVE ID:** CVE-2026-57916, CVE-2026-57917
- **CVSS Score:** Not explicitly listed in report (Assessment: High)
- **CWE:**
- CWE-73 (External Control of File Name or Path)
- CWE-611 (Improper Restriction of XML External Entity Reference)
## Affected Systems
- **Products:** proCertum SmartSign (Asseco)
- **Versions:** All versions prior to 9.4.3.90
- **Configurations:** Systems where the application is used to open or preview signed documents.
## Vulnerability Description
The software suffers from two distinct flaws:
1. **CVE-2026-57916 (Arbitrary File Execution):** The application fails to validate the URI schema for Certificate Practice Statement (CPS) links. An attacker can craft a certificate containing a CPS URI that points to a local executable or a malicious URL. When a victim opens a document signed with this certificate, the application automatically executes the local file or opens the URL.
2. **CVE-2026-57917 (XXE Injection):** The software improperly parses XML external entities within signature files. This allows for XML External Entity (XXE) attacks, which can lead to Server-Side Request Forgery (SSRF) and the unauthorized reading of local files. Notably, this is triggered during the file preview process in the selection window, requiring minimal user interaction.
## Exploitation
- **Status:** PoC described in advisory; no reports of exploitation in the wild.
- **Complexity:** Medium (Requires crafting a malicious certificate/signature).
- **Attack Vector:** Local/File-based (The victim must interact with a malicious document).
## Impact
- **Confidentiality:** High (Local file disclosure via XXE).
- **Integrity:** High (Execution of arbitrary local binaries).
- **Availability:** Medium (Potential system corruption via executed files).
## Remediation
### Patches
- **proCertum SmartSign version 9.4.3.90** or later addresses both vulnerabilities. Users should update immediately.
### Workarounds
- Avoid opening or previewing signed documents from untrusted or unknown sources.
- Restrict folder permissions where the application is allowed to execute files, if possible.
## Detection
- **Indicators of Compromise:**
- Presence of certificates containing `file://` or non-standard URI schemes in the CPS field.
- Unexpected outbound network traffic (SSRF) or local file access patterns originating from the SmartSign process.
- **Tools:** Use file integrity monitoring or EDR solutions to monitor for child processes spawned by `SmartSign.exe`.
## References
- **Vendor:** hxxps[://]www[.]asseco[.]pl/
- **CERT Polska Advisory:** hxxps[://]cert[.]pl/en/posts/2026/07/vulnerabilities-in-procertum-smartsign/
- **CVE-2026-57916:** hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-57916
- **CVE-2026-57917:** hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-57917