Executive Summary

This vulnerability affects GoSign Desktop versions 2.4.0 and earlier, where the update manifest used to distribute application updates is unsigned. Although the manifest includes package URLs and SHA-256 hashes, it is not digitally signed, relying only on the TLS channel for authenticity. However, if a proxy is configured, TLS certificate validation can be disabled, allowing an attacker who intercepts network traffic to provide a malicious update manifest and package with a matching hash. This can lead to the client downloading and installing a tampered update, resulting in arbitrary code execution with the privileges of the GoSign Desktop user on Windows and macOS, or elevated privileges on some Linux systems. Additionally, a local attacker who can modify proxy settings may exploit this to escalate privileges by forcing installation of a crafted update.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary code on your system with the privileges of the GoSign Desktop user on Windows and macOS, or with elevated privileges on some Linux deployments. This means an attacker could potentially take control of your system, install malicious software, or perform unauthorized actions. A local attacker could also escalate their privileges by exploiting this vulnerability through proxy settings manipulation.

Useful 0 Not Useful 0