- Name: TLS Verification Bypass and Insecure Update in GoSign Desktop
- CVEs: CVE-2025-34324, CVE-2025-34327
- System Affected: GoSign Desktop <= 2.4.0
- Fix: FoSign Desktop 2.4.1 (partially fixed)
- Vendor: Tinexta InfoCert S.p.A.
- Severity: High 8.2/10
- CVSS 3.1: AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
- Advisory: https://www.ush.it/team/ush/hack-gosign-desktop_240/gosign-desktop-exec.txt
- PoC: https://github.com/siddolo/gosign-desktop-exploit-poc
- Author: Pasquale 'sid' Fiorillo
- Contributors: Francesco 'ascii' Ongaro; Marco Lunardi
- Date: 20251003
Il Proof of Concept fornito ha come target un'installazione di GoSign Desktop su Linux Debian/Ubuntu con architettura amd64 e simula un privilege escalation a root da parate di un attaccante locale.
Versione vulnerabile: 2.4.0.
Dopo l'exploit dovrai reinstallare GoSign Desktop riscaricandolo dal sito ufficiale poiché questo viene sostituito dall'aggiornamento fasullo. La configurazione di GoSign Desktop viene preservata.
Compila il finto pacchetto di aggiornamento .deb, crea il virtual environment python con le dipendenze necessarie all'exploit.
make
Configura l'exploit come proxy di GoSign Desktop per simulare l'attacco.
make run
Dopo aver installato il finto pacchetto di aggiornamento .deb puoi verificare l'impatto controllando il file /tmp/gosigndesktop_mitm_poc.log.
cat /tmp/gosigndesktop_mitm_poc.log
Puoi rimuovere la configurazione del proxy, il file .deb e il virtual environment.
make clean
Pasquale "sid" Fiorillo is credited with the discovery of this vulnerability with the contribution of Francesco "ascii" Ongaro and Marco Lunardi.
Pasquale 'sid' Fiorillo
web site: http://www.ush.it/
mail: sid AT ush DOT it
Francesco "ascii" Ongaro
Website: https://www.ush.it/
Email: ascii AT ush DOT it
Copyright (c) 2025 Pasquale 'sid' Fiorillo
Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without mine express written consent. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email me for permission.
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.