Multiple Vulnerabilities in GoSign Desktop leads to Remote Code Execution

• Name: TLS Verification Bypass and Insecure Update in GoSign Desktop
• CVEs: CVE-2025-34324, CVE-2025-34327
• System Affected: GoSign Desktop <= 2.4.0
• Fix: FoSign Desktop 2.4.1 (partially fixed)
• Vendor: Tinexta InfoCert S.p.A.
• Severity: High 8.2/10
• CVSS 3.1: AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
• Advisory: https://www.ush.it/team/ush/hack-gosign-desktop_240/gosign-desktop-exec.txt
• PoC: https://github.com/siddolo/gosign-desktop-exploit-poc
• Author: Pasquale 'sid' Fiorillo
• Contributors: Francesco 'ascii' Ongaro; Marco Lunardi
• Date: 20251003

Details

https://www.ush.it/2025/11/14/vulnerabilita-multiple-gosign-desktop-esecuzione-remota-codice-arbitrario/

Proof of Concept

The provided Proof of Concept targets a GoSign Desktop installation on Linux Debian/Ubuntu with amd64 architecture and simulates a privilege escalation to root from a local attacker.

Vulnerable version: 2.4.0.

After the exploit, you will need to reinstall GoSign Desktop by downloading it again from the official website, as it gets replaced by the fake update. GoSign Desktop configuration is preserved.

Build

Compile the fake update package .deb, create the Python virtual environment with the dependencies required for the exploit.

make

Run

Configure the exploit as a proxy for GoSign Desktop to simulate the attack.

make run

PoC Evidence

After installing the fake update package .deb, you can verify the impact by checking the file /tmp/gosigndesktop_mitm_poc.log.

cat /tmp/gosigndesktop_mitm_poc.log

Cleanup

You can remove the proxy configuration, the .deb file, and the virtual environment.

make clean

CREDITS

Pasquale "sid" Fiorillo is credited with the discovery of this vulnerability with the contribution of Francesco "ascii" Ongaro and Marco Lunardi.

Pasquale 'sid' Fiorillo

web site: http://www.ush.it/

mail: sid AT ush DOT it

Francesco "ascii" Ongaro

Website: https://www.ush.it/

Email: ascii AT ush DOT it

LEGAL NOTICES

Copyright (c) 2025 Pasquale 'sid' Fiorillo

Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without mine express written consent. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email me for permission.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.