CVE-2023-33298
📋 TL;DR
This vulnerability in Perimeter81's macOS agent allows local attackers to escalate privileges to root by injecting shell metacharacters into the usingCAPath parameter. It affects macOS systems running Perimeter81 version 10.0.0.19. Attackers with local access can gain full system control.
💻 Affected Systems
- Perimeter81 macOS Agent
📦 What is this software?
Xpc Helpertool by Perimeter81
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root access, allowing installation of persistent malware, data theft, and lateral movement across the network.
Likely Case
Local privilege escalation enabling attackers to bypass security controls, install unauthorized software, and access sensitive system files.
If Mitigated
Limited impact if proper access controls restrict local user privileges and the vulnerable component is isolated.
🎯 Exploit Status
Exploitation requires local access but is straightforward once access is obtained. Public proof-of-concept details shell metacharacter injection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 10.0.0.19
Vendor Advisory: https://support.perimeter81.com/docs/macos-agent-release-notes
Restart Required: Yes
Instructions:
1. Update Perimeter81 macOS agent to latest version. 2. Restart the system. 3. Verify the update was successful.
🔧 Temporary Workarounds
Remove vulnerable version
macOSUninstall Perimeter81 agent version 10.0.0.19 if immediate update is not possible
sudo /Applications/Perimeter81.app/Contents/Resources/uninstall.sh
Restrict local access
allImplement strict access controls to limit who can log into affected systems
🧯 If You Can't Patch
- Remove the Perimeter81 agent completely from affected systems
- Implement strict user privilege management and monitor for suspicious local activity
🔍 How to Verify
Check if Vulnerable:
Check if Perimeter81 agent version 10.0.0.19 is installed: Check application version in GUI or look for installation files.Check Version:
Check application version in Perimeter81 GUI or examine installation directory for version informationVerify Fix Applied:
Verify Perimeter81 agent version is updated beyond 10.0.0.19 through the application interface or system logs.📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation attempts
- Shell command execution with metacharacters in usingCAPath parameter
- Unexpected root access by non-admin users
Network Indicators:
- None - this is a local exploit
SIEM Query:
Search for process execution events where parent process is Perimeter81 helper tool and child process has elevated privileges🔗 References
- https://support.perimeter81.com/docs/macos-agent-release-notes
- https://www.kb.cert.org/vuls/id/653767
- https://www.ns-echo.com/posts/cve_2023_33298.html
- https://support.perimeter81.com/docs/macos-agent-release-notes
- https://www.kb.cert.org/vuls/id/653767
- https://www.ns-echo.com/posts/cve_2023_33298.html
