From 59eff318ad7f60e5da61272898f59a5ad52bcf15 Mon Sep 17 00:00:00 2001
From: chanelyoung <chanelyoung@microsoft.com>
Date: Mon, 27 Jul 2026 14:07:14 -0700
Subject: [PATCH] adding powershell dont install root cert query

---
 .../cwe-327/DontInstallRootCert.qhelp         | 38 +++++++++++++++++++
 .../security/cwe-327/DontInstallRootCert.ql   | 32 ++++++++++++++++
 .../examples/DontInstallRootCertBad.ps1       |  3 ++
 .../examples/DontInstallRootCertGood.ps1      |  2 +
 4 files changed, 75 insertions(+)
 create mode 100644 powershell/ql/src/queries/security/cwe-327/DontInstallRootCert.qhelp
 create mode 100644 powershell/ql/src/queries/security/cwe-327/DontInstallRootCert.ql
 create mode 100644 powershell/ql/src/queries/security/cwe-327/examples/DontInstallRootCertBad.ps1
 create mode 100644 powershell/ql/src/queries/security/cwe-327/examples/DontInstallRootCertGood.ps1

diff --git a/powershell/ql/src/queries/security/cwe-327/DontInstallRootCert.qhelp b/powershell/ql/src/queries/security/cwe-327/DontInstallRootCert.qhelp
new file mode 100644
index 000000000000..f4f21ebeaa4d
--- /dev/null
+++ b/powershell/ql/src/queries/security/cwe-327/DontInstallRootCert.qhelp
@@ -0,0 +1,38 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+  <overview>
+    <p>
+      Adding certificates to the system root certificate store (e.g.,
+      <code>Cert:\LocalMachine\Root</code>) weakens security for all applications running on
+      the same machine. Any certificate in the root store is trusted as a certificate authority,
+      which means a malicious or compromised certificate could be used to intercept encrypted
+      communications or impersonate trusted services for all users on the system.
+    </p>
+  </overview>
+  <recommendation>
+    <p>
+      Instead of importing certificates into the root store, use an application-specific or
+      user-specific certificate store such as <code>Cert:\CurrentUser\My</code> or
+      <code>Cert:\LocalMachine\My</code>. If root trust is genuinely required, ensure the
+      operation is restricted to controlled environments and the certificate is removed after use.
+    </p>
+  </recommendation>
+  <example>
+    <p>
+      The following example imports a certificate directly into the root store, weakening security
+      for all applications on the system:
+    </p>
+    <sample src="examples/DontInstallRootCertBad.ps1" />
+
+    <p>
+      The following example imports the certificate into a user-specific store, limiting the
+      scope of trust:
+    </p>
+    <sample src="examples/DontInstallRootCertGood.ps1" />
+  </example>
+  <references>
+    <li>Microsoft: <a href="https://learn.microsoft.com/en-us/powershell/module/pki/import-certificate">Import-Certificate</a>.</li>
+    <li>Microsoft: <a href="https://learn.microsoft.com/en-us/powershell/module/pki/import-pfxcertificate">Import-PfxCertificate</a>.</li>
+    <li>CWE-327: <a href="https://cwe.mitre.org/data/definitions/327.html">Use of a Broken or Risky Cryptographic Algorithm</a>.</li>
+  </references>
+</qhelp>
diff --git a/powershell/ql/src/queries/security/cwe-327/DontInstallRootCert.ql b/powershell/ql/src/queries/security/cwe-327/DontInstallRootCert.ql
new file mode 100644
index 000000000000..73d0ad1afd07
--- /dev/null
+++ b/powershell/ql/src/queries/security/cwe-327/DontInstallRootCert.ql
@@ -0,0 +1,32 @@
+/**
+ * @name Do not add certificates to the system root store
+ * @description Adding certificates to the system root certificate store weakens security for all
+ *              applications running on the same machine by trusting potentially untrusted
+ *              certificate authorities.
+ * @kind problem
+ * @problem.severity error
+ * @security-severity 7.5
+ * @precision high
+ * @id powershell/adding-cert-to-root-store
+ * @tags security
+ *       external/cwe/cwe-327
+ */
+
+import powershell
+
+/**
+ * A call to `Import-Certificate` or `Import-PfxCertificate` that targets the root certificate store.
+ */
+class ImportCertToRootStore extends CmdCall {
+  ImportCertToRootStore() {
+    this.getAName() = ["Import-Certificate", "Import-PfxCertificate"] and
+    exists(Expr loc |
+      loc = this.getNamedArgument("certstorelocation") and
+      loc.getValue().stringMatches("%Root%")
+    )
+  }
+}
+
+from ImportCertToRootStore call
+select call,
+  "This call adds a certificate to the root certificate store, which weakens security for all applications on the machine."
diff --git a/powershell/ql/src/queries/security/cwe-327/examples/DontInstallRootCertBad.ps1 b/powershell/ql/src/queries/security/cwe-327/examples/DontInstallRootCertBad.ps1
new file mode 100644
index 000000000000..edb2556c961a
--- /dev/null
+++ b/powershell/ql/src/queries/security/cwe-327/examples/DontInstallRootCertBad.ps1
@@ -0,0 +1,3 @@
+# BAD: Importing a certificate into the root store weakens security for all
+# applications on the machine.
+Import-Certificate -FilePath "C:\certs\my-cert.cer" -CertStoreLocation Cert:\LocalMachine\Root
diff --git a/powershell/ql/src/queries/security/cwe-327/examples/DontInstallRootCertGood.ps1 b/powershell/ql/src/queries/security/cwe-327/examples/DontInstallRootCertGood.ps1
new file mode 100644
index 000000000000..ee84f9bdd2f8
--- /dev/null
+++ b/powershell/ql/src/queries/security/cwe-327/examples/DontInstallRootCertGood.ps1
@@ -0,0 +1,2 @@
+# GOOD: Importing a certificate into a user-specific store limits the scope of trust.
+Import-Certificate -FilePath "C:\certs\my-cert.cer" -CertStoreLocation Cert:\CurrentUser\My