CVE-2020-25736
📋 TL;DR
This vulnerability allows local attackers on macOS systems to escalate privileges from a standard user account to root due to insecure XPC service configuration in Acronis True Image. It affects macOS users running Acronis True Image 2019 update 1 through 2021 update 1. The flaw enables unauthorized access to privileged operations.
💻 Affected Systems
- Acronis True Image
📦 What is this software?
True Image by Acronis
True Image by Acronis
True Image by Acronis
True Image by Acronis
True Image by Acronis
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full root access to the macOS system, enabling complete system compromise, data theft, persistence installation, and lateral movement.
Likely Case
Local user escalates privileges to install malware, modify system files, or access protected data without authorization.
If Mitigated
With proper privilege separation and service hardening, impact limited to denial of service of the Acronis service.
🎯 Exploit Status
Exploit requires local user access but privileges can be escalated without authentication to the vulnerable service. Proof-of-concept code is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2021 update 2 and later
Vendor Advisory: https://kb.acronis.com/content/68061
Restart Required: Yes
Instructions:
1. Open Acronis True Image. 2. Check for updates in application settings. 3. Install update to version 2021 update 2 or later. 4. Restart the system to ensure service updates are applied.
🔧 Temporary Workarounds
Disable Acronis True Image Service
allTemporarily disable the vulnerable XPC service to prevent exploitation
sudo launchctl unload /Library/LaunchDaemons/com.acronis.trueimage.plist
Remove Setuid Permissions
allRemove unnecessary privilege escalation capabilities from Acronis binaries
sudo chmod -s /Applications/Acronis\ True\ Image.app/Contents/MacOS/*
🧯 If You Can't Patch
- Restrict local user access to systems running vulnerable versions
- Implement application whitelisting to prevent unauthorized privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Acronis True Image version in About dialog or run: /Applications/Acronis\ True\ Image.app/Contents/MacOS/TrueImage --versionCheck Version:
/Applications/Acronis\ True\ Image.app/Contents/MacOS/TrueImage --versionVerify Fix Applied:
Verify version is 2021 update 2 or later and check that XPC service permissions are properly restricted📡 Detection & Monitoring
Log Indicators:
- Unauthorized privilege escalation attempts in system logs
- Unexpected process launches from Acronis binaries with root privileges
Network Indicators:
- Local XPC communication attempts to Acronis services
SIEM Query:
process_name:"TrueImage" AND parent_process:"launchd" AND user:"root"🔗 References
- http://packetstormsecurity.com/files/170246/Acronis-TrueImage-XPC-Privilege-Escalation.html
- https://kb.acronis.com/content/68061
- https://www.acronis.com/en-us/blog/
- http://packetstormsecurity.com/files/170246/Acronis-TrueImage-XPC-Privilege-Escalation.html
- https://kb.acronis.com/content/68061
- https://www.acronis.com/en-us/blog/
