CVE-2025-34324
📋 TL;DR
GoSign Desktop versions 2.4.0 and earlier have an insecure update mechanism that allows attackers to execute arbitrary code. The vulnerability occurs because the update manifest isn't digitally signed, and TLS certificate validation can be disabled when a proxy is configured. This affects all users of vulnerable versions on Windows, macOS, and Linux systems.
💻 Affected Systems
- GoSign Desktop
📦 What is this software?
Gosign by Infocert
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via remote code execution with user privileges (or elevated privileges on Linux), potentially leading to data theft, ransomware deployment, or complete system control.
Likely Case
Local privilege escalation by attackers who can modify proxy settings, or network-based attacks in environments where TLS interception is possible.
If Mitigated
Limited to authenticated attackers with network access or local users who can modify proxy configurations.
🎯 Exploit Status
Exploitation requires either network interception capability or local access to modify proxy settings. Public technical details are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.1 or later
Vendor Advisory: https://infocert.digital/consumer/gosign-suite/
Restart Required: Yes
Instructions:
1. Download GoSign Desktop version 2.4.1 or later from official vendor site. 2. Install the update. 3. Restart the application. 4. Verify the update was successful by checking the version number.
🔧 Temporary Workarounds
Disable proxy configuration
allPrevent TLS certificate validation bypass by removing or disabling proxy settings in GoSign Desktop.
Check application settings for proxy configuration and disable it
Network segmentation
allIsolate GoSign Desktop systems from untrusted networks to prevent traffic interception.
🧯 If You Can't Patch
- Remove GoSign Desktop from systems where it's not essential
- Implement strict network controls to prevent traffic interception and limit who can modify proxy settings
🔍 How to Verify
Check if Vulnerable:
Check GoSign Desktop version in application settings or About dialog. If version is 2.4.0 or earlier, the system is vulnerable.Check Version:
On Windows: Check Help > About in GoSign Desktop. On macOS/Linux: Check application menu > About GoSign Desktop.Verify Fix Applied:
Verify version is 2.4.1 or later in application settings. Check that update manifest validation is now properly implemented.📡 Detection & Monitoring
Log Indicators:
- Unexpected update downloads
- Proxy configuration changes
- Failed TLS certificate validations
- Unusual process execution from GoSign Desktop
Network Indicators:
- Unusual update server connections
- Manifest downloads from non-standard sources
- TLS interception attempts
SIEM Query:
process_name:"GoSign Desktop" AND (event_type:"process_creation" OR event_type:"network_connection") AND (destination_ip NOT IN [official_update_servers] OR proxy_config_changed:true)🔗 References
- https://infocert.digital/consumer/gosign-suite/
- https://www.ush.it/2025/11/14/multiple-vulnerabilities-gosign-desktop-remote-code-execution/
- https://www.ush.it/2025/11/14/vulnerabilita-multiple-gosign-desktop-esecuzione-remota-codice-arbitrario/
- https://www.vulncheck.com/advisories/gosign-desktop-insecure-update-mechanism-rce
- https://www.ush.it/2025/11/14/multiple-vulnerabilities-gosign-desktop-remote-code-execution/
- https://www.ush.it/2025/11/14/vulnerabilita-multiple-gosign-desktop-esecuzione-remota-codice-arbitrario/
