CVE-2023-27574
📋 TL;DR
ShadowsocksX-NG 1.10.0 contains a vulnerability where the application is signed with com.apple.security.get-task-allow entitlements due to CODE_SIGNING_INJECT_BASE_ENTITLEMENTS. This allows attackers to attach debuggers and potentially execute arbitrary code. All users running the affected version on macOS are impacted.
💻 Affected Systems
- ShadowsocksX-NG
📦 What is this software?
Shadowsocksx Ng by Shadowsocks
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through arbitrary code execution, potentially leading to data theft, persistence, and lateral movement.
Likely Case
Local privilege escalation allowing attackers to gain elevated privileges and access sensitive system resources.
If Mitigated
Limited impact if proper application sandboxing and code signing verification are enforced.
🎯 Exploit Status
Exploitation requires local access to the system. The vulnerability is in the code signing configuration, making exploitation straightforward for attackers with local access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.10.1 and later
Vendor Advisory: https://github.com/shadowsocks/ShadowsocksX-NG/pull/1456
Restart Required: Yes
Instructions:
1. Download the latest version from the official ShadowsocksX-NG repository. 2. Uninstall the vulnerable version. 3. Install the patched version. 4. Restart the application.
🔧 Temporary Workarounds
Disable CODE_SIGNING_INJECT_BASE_ENTITLEMENTS
macOSRebuild the application without the problematic code signing flag
Build from source with CODE_SIGNING_INJECT_BASE_ENTITLEMENTS disabled
🧯 If You Can't Patch
- Restrict local access to systems running vulnerable versions
- Implement strict application sandboxing policies
🔍 How to Verify
Check if Vulnerable:
Check if ShadowsocksX-NG version is 1.10.0. Use 'codesign -d --entitlements - /Applications/ShadowsocksX-NG.app' to verify entitlements.Check Version:
Check application version in About dialog or inspect Info.plist in the application bundle.Verify Fix Applied:
Verify version is 1.10.1 or later. Check that com.apple.security.get-task-allow entitlement is not present.📡 Detection & Monitoring
Log Indicators:
- Unexpected debugger attachments to ShadowsocksX-NG process
- Unusual privilege escalation attempts
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
Process creation events for debuggers (lldb, gdb) attaching to ShadowsocksX-NG process