CVE-2023-41902
📋 TL;DR
This vulnerability allows attackers to escalate privileges on macOS systems by exploiting an XPC misconfiguration in CoreCode MacUpdater. Attackers can craft malicious .pkg files that, when processed by vulnerable versions, enable unauthorized privilege escalation. This affects users running MacUpdater versions before 2.3.8 or 3.x before 3.1.2.
💻 Affected Systems
- CoreCode MacUpdater
📦 What is this software?
Macupdater by Corecode
Macupdater by Corecode
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root privileges, allowing installation of persistent malware, data theft, and complete system control.
Likely Case
Local privilege escalation to root, enabling installation of additional malicious software and bypassing macOS security controls.
If Mitigated
No impact if patched versions are used or if malicious .pkg files are prevented from reaching the system.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious .pkg file. Public proof-of-concept exists in the referenced GitHub gist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.8 for version 2.x, 3.1.2 for version 3.x
Vendor Advisory: https://www.corecode.io/macupdater/history2.html and https://www.corecode.io/macupdater/history3.html
Restart Required: No
Instructions:
1. Open MacUpdater. 2. Go to 'Check for Updates' in the menu. 3. Install the available update to version 2.3.8 or 3.1.2. 4. Alternatively, download the latest version from the official website and install it.
🔧 Temporary Workarounds
Disable automatic .pkg processing
macosConfigure macOS to not automatically open .pkg files and require manual verification
Restrict .pkg file sources
macosOnly allow .pkg files from trusted sources and implement application whitelisting
🧯 If You Can't Patch
- Uninstall MacUpdater if not essential for operations
- Implement strict controls on .pkg file execution and educate users about the risks of opening untrusted packages
🔍 How to Verify
Check if Vulnerable:
Check MacUpdater version in the application's 'About' menu or by running: /Applications/MacUpdater.app/Contents/MacOS/MacUpdater --versionCheck Version:
/Applications/MacUpdater.app/Contents/MacOS/MacUpdater --versionVerify Fix Applied:
Verify version is 2.3.8 or higher for version 2.x, or 3.1.2 or higher for version 3.x📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation events in macOS system logs
- MacUpdater process spawning with elevated privileges unexpectedly
Network Indicators:
- Downloads of suspicious .pkg files from untrusted sources
SIEM Query:
process_name:"MacUpdater" AND parent_process_name:"launchd" AND process_integrity_level:"System"🔗 References
- https://gist.github.com/NSEcho/5d048a0796ceef59d6b1df1659bd1057
- https://www.corecode.io/macupdater/history2.html
- https://www.corecode.io/macupdater/history3.html
- https://gist.github.com/NSEcho/5d048a0796ceef59d6b1df1659bd1057
- https://www.corecode.io/macupdater/history2.html
- https://www.corecode.io/macupdater/history3.html
