CVE-2025-13733
📋 TL;DR
BuhoNTFS version 1.3.2 contains an insecure XPC service that allows local, unprivileged users to execute arbitrary code with root privileges. This affects macOS systems where BuhoNTFS is installed, enabling privilege escalation attacks.
💻 Affected Systems
- BuhoNTFS
📦 What is this software?
Buhontfs by Drbuho
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full root access to the system, allowing complete compromise, data theft, persistence installation, and lateral movement.
Likely Case
Local user or malware escalates privileges to install additional payloads, modify system files, or access protected data.
If Mitigated
Attack limited to local users with physical or remote access to the system; network services remain unaffected.
🎯 Exploit Status
Exploitation requires local access but is straightforward once local access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.drbuho.com/buhontfs
Restart Required: No
Instructions:
1. Check vendor website for updated version. 2. Uninstall vulnerable version. 3. Install patched version if available.
🔧 Temporary Workarounds
Uninstall BuhoNTFS
allRemove the vulnerable software completely
sudo rm -rf /Applications/BuhoNTFS.app
sudo rm -rf ~/Library/Application\ Support/BuhoNTFS
sudo rm -rf /Library/LaunchDaemons/com.drbuho.buhontfs.plist
Disable XPC Service
allDisable the vulnerable XPC service
sudo launchctl unload /Library/LaunchDaemons/com.drbuho.buhontfs.plist
sudo launchctl disable system/com.drbuho.buhontfs
🧯 If You Can't Patch
- Restrict local user access to systems with BuhoNTFS installed
- Implement strict privilege separation and monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check if BuhoNTFS version 1.3.2 is installed: ls /Applications/ | grep -i buhontfsCheck Version:
Check app bundle version or use: defaults read /Applications/BuhoNTFS.app/Contents/Info.plist CFBundleShortVersionStringVerify Fix Applied:
Verify BuhoNTFS is not installed or is updated to a version later than 1.3.2📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events
- Processes running as root from non-privileged users
- XPC service communication anomalies
Network Indicators:
- Local privilege escalation typically has minimal network indicators
SIEM Query:
process where parent_process_name contains 'BuhoNTFS' and user_id changes from non-zero to 0