GoSign Desktop TLS Validation Bypass Vulnerability Allowing Man-in-the-Middle Attacks

A vulnerability in GoSign Desktop versions through 2.4.1 allows for TLS certificate validation to be bypassed when the application is configured to use a proxy server. This could lead to integrity protection being compromised, as it allows for potential Man-in-the-Middle (MitM) attacks. The issue arises because the application disables proper certificate validation, leaving users vulnerable if they select an untrusted proxy server. In typical enterprise environments, such connections would be blocked. Additionally, the update mechanism for GoSign Desktop relies on an unsigned manifest, further exposing users to risks.

Impact

Exploitation of this vulnerability can lead to Man-in-the-Middle attacks, where an attacker intercepts and potentially alters communications. This could allow for the interception of sensitive data such as OAuth secrets and access tokens, and in the case of Linux users, could be exploited to escalate privileges through malicious update packages.

Reproduction

To reproduce this vulnerability, configure GoSign Desktop to use a proxy server. Then, initiate an update process or intercept outgoing HTTPS traffic through the proxy. The absence of proper TLS validation will allow interception of sensitive data and manipulation of the update process, potentially leading to remote code execution.

Remediation

Users can update to GoSign Desktop version 2.4.1, which addresses the remote code execution vulnerability and the privilege escalation issue on Linux. However, it's important to note that the TLS validation bypass when using a proxy server has not been fixed.