go-witness CVE-2025-62375

Only deployments using the go-witness/witness AWS attestor are affected. Exploitation requires the attacker to supply or intercept AWS EC2 instance identity document data - in practice an IMDS impersonation or man-in-the-middle position against the metadata service (the scenario cited in AWS Security Bulletin aws-2025-021). Verification wrongly succeeds specifically when the signature is absent/empty or when RSA verification fails; additionally, the attestor embeds only the single legacy global AWS certificate and lacks the 2024 region-specific certificates, so forged documents are hard to detect without externally supplied trusted region certificate data. Limiting factors: impact is confined to attestation trust/integrity (no code execution, no data disclosure), the AWS attestor must actually be in use, and the attacker needs a network interception or IMDS-impersonation foothold rather than purely remote unauthenticated access to a default service.

This is a medium-severity integrity flaw (CWE-295, Improper Certificate Validation) with a genuinely limited real-world risk profile, and the signals are largely consistent. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) shows no confidentiality or availability impact and only LOW integrity impact (VI:L) - the damage is incorrect trust decisions from a forged attestation, not direct code execution or data theft. EPSS is very low (0.20%, 9th percentile), there is NO CISA KEV listing, and no public exploit was identified, so there is no evidence of active or imminent widespread exploitation. One point of tension: the vendor vector rates AC:L/AT:N (easy, no special requirement), yet the GHSA and description make clear that exploitation requires the attacker to supply or intercept Instance Metadata Service (IMDS) data - effectively a privileged network/MITM position - which argues for higher attack complexity or an attack requirement than the published vector reflects. This is a real, legitimate supply-chain trust weakness worth patching for anyone using the AWS attestor, but it is not a drop-everything emergency: the impact is bounded to integrity of attestation trust, exploitation is conditional on a MITM/impersonation foothold, and no exploitation activity is confirmed.

No public exploit was identified at time of analysis. An attacker who can impersonate the EC2 Instance Metadata Service (per AWS's 2025 IMDS impersonation bulletin) or otherwise intercept/supply instance identity document data presents a forged identity document with a missing, empty, or RSA-invalid signature. Because the AWS attestor incorrectly reports successful verification in these cases, the forged document is accepted and downstream supply-chain systems make trust decisions based on a fraudulent attestation.