CVE-2025-61228
📋 TL;DR
A local privilege escalation vulnerability in Shirt Pocket SuperDuper! backup software allows attackers to execute arbitrary code through the software update mechanism. This affects users running version 3.10 and earlier on macOS systems. Attackers with local access can exploit this to gain elevated privileges.
💻 Affected Systems
- Shirt Pocket SuperDuper!
📦 What is this software?
Superduper\! by Shirt Pocket
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root privileges, allowing installation of persistent malware, data theft, and complete control of the affected system.
Likely Case
Local privilege escalation leading to unauthorized software installation, data access, and lateral movement within the network.
If Mitigated
Limited impact if proper access controls and monitoring are in place, though local attackers could still gain elevated privileges.
🎯 Exploit Status
Exploitation requires local access to the system. The CWE-494 classification suggests download of code without integrity check.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.11
Vendor Advisory: https://www.shirtpocket.com/blog/index.php/shadedgrey/comments/superduper_security_update_v311/
Restart Required: Yes
Instructions:
1. Download SuperDuper! version 3.11 from the official website. 2. Install the update following the standard installation process. 3. Restart the system to ensure all components are updated.
🔧 Temporary Workarounds
Disable automatic updates
allPrevent the vulnerable update mechanism from being triggered
Open SuperDuper! > Preferences > Updates > Uncheck 'Check for updates automatically'
Remove update privileges
allRestrict write access to update directories
sudo chmod -R 755 /Applications/SuperDuper!.app/Contents/Resources/
🧯 If You Can't Patch
- Restrict local access to systems running vulnerable versions
- Implement strict privilege separation and monitor for unusual process execution
🔍 How to Verify
Check if Vulnerable:
Check SuperDuper! version in About dialog or run: defaults read /Applications/SuperDuper!.app/Contents/Info.plist CFBundleShortVersionStringCheck Version:
defaults read /Applications/SuperDuper!.app/Contents/Info.plist CFBundleShortVersionStringVerify Fix Applied:
Verify version is 3.11 or higher using the same command📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from SuperDuper! update directories
- Failed update attempts with suspicious payloads
Network Indicators:
- Unexpected outbound connections from SuperDuper! process during update checks
SIEM Query:
process_name:SuperDuper* AND (event_type:process_execution OR event_type:file_write) AND file_path:*update*