CVE-2024-9062: Local Privilege Escalation Vulnerability in Archify Application

Overview

This blog post aims to shed light on the CVE-2024-9062 vulnerability, which poses a significant threat to Archify application users. This specific vulnerability allows local processes to gain unauthorized root-level control, leading to potential system compromise and data leakage. Because Archify is widely used, this vulnerability could affect a large number of users, and the potential damage from its exploitation could be extensive. It is crucial for users and system administrators alike to understand this vulnerability and take the necessary steps to mitigate its risks.

Vulnerability Summary

CVE ID: CVE-2024-9062
Severity: High (CVSS: 7.8)
Attack Vector: Local
Privileges Required: None
User Interaction: Required
Impact: Unauthorized execution of actions with root-level privileges, leading to potential system compromise or data leakage.

Affected Products

Product | Affected Versions

Archify | All versions prior to the patch

How the Exploit Works

The Archify application is structured in the “factored applications” model, where privileged operations are delegated to a helper tool, in this case, com.oct4pie.archifyhelper. This helper runs as root and is exposed via XPC. However, the helper does not verify the code signature, entitlements, or signing flags of the connecting client. Although macOS provides secure validation mechanisms like auditToken, these are not implemented in this case.
Therefore, any local process can connect to the helper and invoke privileged functionality. This results in unauthorized execution of actions with root-level privileges, leading to potential system compromise or data leakage.

Conceptual Example Code

Below is a conceptual example of how this vulnerability might be exploited. In this case, a malicious local process connects to the vulnerable helper tool and sends commands for privileged actions:

# Establish connection to Archify helper tool
xpc_connect("com.oct4pie.archifyhelper")
# Invoke privileged functionality
xpc_send_message("delete_file", "/path/to/important/file")

This example demonstrates how a local process can invoke privileged operations, such as deleting arbitrary files, without proper authorization. This example is merely conceptual and does not represent an actual exploit code.