CVE-2025-61229
📋 TL;DR
A local privilege escalation vulnerability in SuperDuper! backup software allows attackers to modify task templates and execute arbitrary scripts with root privileges and Full Disk Access. This bypasses macOS privacy controls like TCC (Transparency, Consent, and Control). Affects all users running SuperDuper! 3.10 and earlier on macOS systems.
💻 Affected Systems
- SuperDuper!
📦 What is this software?
Superduper\! by Shirt Pocket
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise - attacker gains root access, can install persistent malware, access all files including encrypted data, and bypass all macOS security controls.
Likely Case
Local attacker gains root privileges and Full Disk Access, enabling data theft, surveillance, and installation of backdoors.
If Mitigated
Limited impact if proper access controls prevent local users from modifying SuperDuper! configuration files.
🎯 Exploit Status
Exploitation requires local access to modify SuperDuper! task templates. The attack vector is straightforward once an attacker has local access to the system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.11
Vendor Advisory: https://www.shirtpocket.com/blog/index.php/shadedgrey/comments/superduper_security_update_v311/
Restart Required: No
Instructions:
1. Open SuperDuper! 2. Check for updates via the application menu 3. Download and install version 3.11 4. Verify installation by checking version number
🔧 Temporary Workarounds
Remove SuperDuper! task templates
allDelete or secure SuperDuper! task template files to prevent modification
sudo rm -rf ~/Library/Application\ Support/SuperDuper!/Scheduled\ Copies/*.sdTask
Restrict access to SuperDuper! configuration
allSet strict permissions on SuperDuper! configuration directories
sudo chmod 700 ~/Library/Application\ Support/SuperDuper!/
sudo chown root:wheel ~/Library/Application\ Support/SuperDuper!/Scheduled\ Copies/
🧯 If You Can't Patch
- Uninstall SuperDuper! if not essential for operations
- Implement strict access controls to prevent local users from modifying application files
🔍 How to Verify
Check if Vulnerable:
Check SuperDuper! version: if version is 3.10 or earlier, system is vulnerableCheck Version:
defaults read /Applications/SuperDuper!.app/Contents/Info.plist CFBundleShortVersionStringVerify Fix Applied:
Verify SuperDuper! version is 3.11 or later📡 Detection & Monitoring
Log Indicators:
- Unauthorized modifications to SuperDuper! task template files
- Unexpected root privilege escalation from SuperDuper! processes
- Execution of suspicious scripts from SuperDuper! context
Network Indicators:
- None - this is a local privilege escalation
SIEM Query:
process_name:"SuperDuper!" AND parent_process_name:"sh" OR process_name:"sh" AND parent_process_name:"SuperDuper!"