CVE-2025-34324: Infocert Gosign RCE Vulnerability

CVE-2025-34324 Overview

CVE-2025-34324 affects InfoCert GoSign Desktop versions 2.4.0 and earlier. The application uses an unsigned update manifest to distribute software updates. The manifest lists package URLs and SHA-256 hashes, but lacks a digital signature. Authenticity depends entirely on the underlying TLS channel. TLS certificate validation can be disabled when a proxy is configured, weakening this last line of defense. Attackers positioned to intercept network traffic can supply a malicious manifest and matching package. The client then downloads and installs the tampered update, leading to arbitrary code execution.

Critical Impact
Successful exploitation delivers arbitrary code execution with the GoSign Desktop user's privileges on Windows and macOS, or elevated privileges on some Linux deployments.

Affected Products

InfoCert GoSign Desktop 2.4.0
InfoCert GoSign Desktop versions prior to 2.4.0
Windows, macOS, and Linux installations of GoSign Desktop

Discovery Timeline

2025-11-14 - Vulnerability details published in the USH Vulnerabilities Report
2025-11-18 - CVE-2025-34324 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-34324

Vulnerability Analysis

The flaw is an improper verification of a cryptographic signature [CWE-347] in the GoSign Desktop update workflow. The update manifest carries package URLs and SHA-256 hashes but is never signed. The SHA-256 values only bind a package to a manifest, not to a trusted publisher. Any actor able to serve a controlled manifest with a matching package hash meets the client's integrity check. The application therefore treats attacker-controlled updates as legitimate.

Root Cause

Two design decisions combine to create the vulnerability. First, the update manifest is not digitally signed, so trust hinges on transport-layer authentication. Second, TLS certificate validation can be disabled when a proxy is configured. Under that condition, the client accepts any certificate presented by the update endpoint. There is no code-signing check on the downloaded package to compensate for the missing manifest signature.

Attack Vector

A network-adjacent attacker who can intercept traffic between GoSign Desktop and its update service can deliver a forged manifest and companion package. Because certificate validation is disabled through the proxy path, the malicious server is accepted without warning. A local attacker who can modify proxy settings on the host can also trigger the same behavior to escalate privileges by forcing installation of a crafted update. Exploitation requires user interaction with the update flow.

No verified proof-of-concept code is public. Refer to the VulnCheck Advisory on GoSign RCE and the USH Vulnerabilities Report for further technical detail.

Detection Methods for CVE-2025-34324

Indicators of Compromise

GoSign Desktop update requests routed through unexpected proxy endpoints or non-InfoCert hosts.
Update packages installed from domains that do not match InfoCert's official distribution infrastructure.
Unsigned or newly introduced executables written to GoSign Desktop installation directories outside of a planned update window.
Modifications to system or user proxy configuration immediately preceding a GoSign Desktop update.

Detection Strategies

Monitor endpoints running GoSign Desktop for outbound update traffic that bypasses corporate TLS inspection or terminates at unapproved proxies.
Alert on process launches spawned by the GoSign Desktop updater that do not correspond to known-good binaries or expected child processes.
Track changes to proxy environment variables and system proxy registry keys on hosts with GoSign Desktop installed.

Monitoring Recommendations

Inventory all endpoints running GoSign Desktop versions 2.4.0 or earlier and prioritize them for enhanced monitoring.
Capture and retain TLS session metadata for update endpoints to enable forensic review if tampering is suspected.
Correlate proxy configuration changes with subsequent software installation events to surface potential local privilege escalation attempts.

How to Mitigate CVE-2025-34324

Immediate Actions Required

Upgrade GoSign Desktop to a version later than 2.4.0 once InfoCert releases a fixed build; consult InfoCert channels for current guidance.
Restrict the ability of standard users to modify system or per-user proxy settings on hosts running GoSign Desktop.
Block or tightly control outbound proxy usage for GoSign Desktop update traffic through network policy.
Educate users to reject unexpected update prompts, particularly on systems where proxy settings have recently changed.

Patch Information

InfoCert has not published a vendor advisory URL in the enriched CVE data. Refer to the InfoCert GoSign Suite Overview for official product channels and the VulnCheck Advisory on GoSign RCE for the current fix status. Apply the vendor-supplied update as soon as a version above 2.4.0 becomes available.

Workarounds

Enforce endpoint configuration that prevents disabling TLS certificate validation in application settings.
Route GoSign Desktop update traffic exclusively through trusted, monitored network paths with strict certificate pinning at the perimeter.
Use application allowlisting to prevent execution of GoSign Desktop update binaries that do not match approved hashes.
Consider temporarily disabling in-application automatic updates and managing distribution through a controlled software deployment channel.

bash

# Example: remove user-level proxy environment variables on Linux to reduce abuse surface
unset HTTP_PROXY
unset HTTPS_PROXY
unset http_proxy
unset https_proxy

# Example: enforce system proxy read-only via registry ACL on Windows (illustrative)
icacls "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /deny "%USERNAME%:(WD)"