eParakstītājs 3.0 RCE via Unauthenticated Auto-Update Mechanism

Remote code execution in Latvia's national eID signing software Vulnerability Overview eParakstītājs 3.0 is the Windows desktop client for the Latvian national electronic signature service, eParakst. OffSeq discovered that the application's automatic update mechanism fetches and executes code via an unauthenticated channel that lacks integrity protection. A man-in-the-middle attacker can redirect and serve a forged update executable. The client downloads and executes this file, resulting in arbitrary code execution on the victim's machine. Impact Scope Affected Software: eParakstītājs 3.0 for Windows (< 1.10.0) CVSS Score: 7.3 (High) Attack Vector: Adjacent Network Attack Complexity: Low Attack Requirements: Present Privilege Requirements: None User Interaction: Active Impact: Data Exposure, Data Tampering, and Service Disruption are all rated as "Total" Remediation LVRTC addressed this issue in version 1.10.0. Proof of Concept The finding was demonstrated end-to-end against eParakstītājs 3.0: 1. Build any — our example simply writes the host's device details to as a harmless proof of execution. 2. Run an HTTPS server with a self-signed certificate on port 443 that responds to the descriptor request at with a version number far higher than the installed one, pointing to the payload: 3. Redirect the hostname to the attacker on the victim host (simulating ARP spoofing, a rogue access point, or an evil-twin network): 4. Launch eParakstītājs 3.0. Approximately two seconds after startup, the server received two requests—the descriptor followed by —and appeared on the victim system. The self-signed certificate was accepted, the unsigned descriptor was trusted, and the unsigned executable was downloaded and executed: arbitrary code execution achieved merely by launching the application.

Goal Reached Thanks to every supporter — we hit 100%!

eParakstītājs 3.0 RCE via Unauthenticated Auto-Update Mechanism