Multiple Vulnerabilities in GoSign Desktop leads to Remote Code Execution

• Name: TLS Verification Bypass and Insecure Update in GoSign Desktop
• CVEs: CVE-2025-34324, CVE-2025-34327
• System Affected: GoSign Desktop <= 2.4.0
• Fix: FoSign Desktop 2.4.1 (partially fixed)
• Vendor: Tinexta InfoCert S.p.A.
• Severity: High 8.2/10
• CVSS 3.1: AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
• Advisory: https://www.ush.it/team/ush/hack-gosign-desktop_240/gosign-desktop-exec.txt
• PoC: https://github.com/siddolo/gosign-desktop-exploit-poc
• Author: Pasquale 'sid' Fiorillo
• Contributors: Francesco 'ascii' Ongaro; Marco Lunardi
• Date: 20251003

Dettagli

https://www.ush.it/2025/11/14/vulnerabilita-multiple-gosign-desktop-esecuzione-remota-codice-arbitrario/

Proof of Concept

Il Proof of Concept fornito ha come target un'installazione di GoSign Desktop su Linux Debian/Ubuntu con architettura amd64 e simula un privilege escalation a root da parate di un attaccante locale.

Versione vulnerabile: 2.4.0.

Dopo l'exploit dovrai reinstallare GoSign Desktop riscaricandolo dal sito ufficiale poiché questo viene sostituito dall'aggiornamento fasullo. La configurazione di GoSign Desktop viene preservata.

Build

Compila il finto pacchetto di aggiornamento .deb, crea il virtual environment python con le dipendenze necessarie all'exploit.

make

Run

Configura l'exploit come proxy di GoSign Desktop per simulare l'attacco.

make run

PoC Evidence

Dopo aver installato il finto pacchetto di aggiornamento .deb puoi verificare l'impatto controllando il file /tmp/gosigndesktop_mitm_poc.log.

cat /tmp/gosigndesktop_mitm_poc.log

Pulizia

Puoi rimuovere la configurazione del proxy, il file .deb e il virtual environment.

make clean

CREDITS

Pasquale "sid" Fiorillo is credited with the discovery of this vulnerability with the contribution of Francesco "ascii" Ongaro and Marco Lunardi.

Pasquale 'sid' Fiorillo

web site: http://www.ush.it/

mail: sid AT ush DOT it

Francesco "ascii" Ongaro

Website: https://www.ush.it/

Email: ascii AT ush DOT it

LEGAL NOTICES

Copyright (c) 2025 Pasquale 'sid' Fiorillo

Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without mine express written consent. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email me for permission.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.