CVE-2024-9062
macOS Archify: Local Privilege Escalation
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
macOS Archify: Local Privilege Escalation
The Archify application contains a local privilege escalation vulnerability due to insufficient client validation in its privileged helper tool, com.oct4pie.archifyhelper, which is exposed via XPC. Archify follows the "factored applications" model, delegating privileged operations—such as arbitrary file deletion and file permission changes—to this helper running as root. However, the helper does not verify the code signature, entitlements, or signing flags of the connecting client. Although macOS provides secure validation mechanisms like auditToken, these are not implemented. As a result, any local process can establish a connection to the helper and invoke privileged functionality, leading to unauthorized execution of actions with root-level privileges.
Reserved 2024-09-20 | Published 2025-06-10 | Updated 2025-06-11 | Assigner PentrazeCWE-306 Missing Authentication for Critical Function
Carlos Garrido of Pentraze Cybersecurity
pentraze.com/vulnerability-reports/
Support options
