PT-2025-47339 · Unknown · Gosign Desktop

Marco Lunardi · Published 2025-11-18 · Updated 2025-11-19 · CVE-2025-34324

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GoSign Desktop versions 2.4.0 and earlier

Description GoSign Desktop versions 2.4.0 and earlier utilize an unsigned update manifest for application updates. This manifest includes package URLs and SHA-256 hashes, but lacks digital signing, relying on the TLS channel for authenticity. When TLS certificate validation is disabled through proxy configuration, an attacker intercepting network traffic can provide a malicious update manifest and package with a matching hash. This can lead to the download and installation of a compromised update, potentially resulting in arbitrary code execution with the privileges of the GoSign Desktop user on Windows and macOS, or with elevated privileges on certain Linux deployments. A local attacker modifying proxy settings can also exploit this to escalate privileges by installing a crafted update.

Recommendations Update GoSign Desktop to a version later than 2.4.0.

Exploit

Fix

RCE

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2025-34324

Affected Products

Gosign Desktop

References · 9

• 🔥 https://ush.it/2025/11/14/vulnerabilita-multiple-gosign-desktop-esecuzione-remota-codice-arbitrario · Exploit
• 🔥 https://ush.it/2025/11/14/multiple-vulnerabilities-gosign-desktop-remote-code-execution · Exploit
• https://osv.dev/vulnerability/CVE-2025-34324 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34324 · Security Note
• https://infocert.digital/consumer/gosign-suite · Note
• https://t.me/CVEtracker/37627 · Telegram Post
• https://t.me/cveNotify/143242 · Telegram Post
• https://twitter.com/CVEnew/status/1991042984784101680 · Twitter Post
• https://vulncheck.com/advisories/gosign-desktop-insecure-update-mechanism-rce · Note