EUVD-2024-54672CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
The Archify application contains a local privilege escalation vulnerability due to insufficient client validation in its privileged helper tool, com.oct4pie.archifyhelper, which is exposed via XPC. Archify follows the "factored applications" model, delegating privileged operations-such as arbitrary file deletion and file permission changes-to this helper running as root. However, the helper does not verify the code signature, entitlements, or signing flags of the connecting client. Although macOS provides secure validation mechanisms like auditToken, these are not implemented. As a result, any local process can establish a connection to the helper and invoke privileged functionality, leading to unauthorized execution of actions with root-level privileges.
Analysis
Local privilege escalation vulnerability in Archify's privileged helper tool (com.oct4pie.archifyhelper) that fails to validate client code signatures, entitlements, or signing flags over XPC. Any local process can invoke the helper to execute arbitrary file operations (deletion, permission changes) with root privileges. With a CVSS score of 7.8 and CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, this vulnerability requires local access and low privileges but enables complete system compromise; KEV status, EPSS score, patch availability, and POC status are not provided in available intelligence sources.
Technical Context
This vulnerability exploits a flaw in macOS XPC (inter-process communication) security architecture. Archify follows the 'factored applications' architectural model, where a client application with standard user privileges delegates sensitive operations to a privileged helper daemon running as root. The helper tool, com.oct4pie.archifyhelper, exposes XPC endpoints for privileged operations including arbitrary file deletion and permission modification. The root cause (CWE-306: Missing Authentication for Critical Function) is the absence of client validation mechanisms. macOS provides secure validation primitives—auditToken for process identity verification and code signature/entitlements validation via SecCode APIs—but Archify's helper does not implement any of these checks. Any process on the local system can establish an XPC connection and invoke helper methods without authentication, bypassing the intended privilege separation model.
Affected Products
Archify application and all versions leveraging the com.oct4pie.archifyhelper XPC service. The vendor is Oct4Pie. Specific version ranges are not documented in available intelligence; affected versions likely include current and recent releases that depend on this privileged helper architecture. Without CPE identifiers or vendor-published advisory links, the exact version scope cannot be pinpointed. Users should assume all versions using the com.oct4pie.archifyhelper XPC service are affected unless explicitly patched.
Remediation
Immediate remediation requires vendor patch implementation: (1) Deploy code signature validation in the helper tool using SecCode APIs to verify the connecting client's code signature before accepting XPC connections; (2) Implement entitlements-based access control, restricting helper access only to signed copies of the official Archify client application with required entitlements; (3) Implement auditToken-based validation to verify process identity and prevent spoofing; (4) Add authorization checks for individual XPC methods to enforce least privilege. Until patches are available, mitigation strategies include: (a) Restrict Archify installation to single-user systems or trusted administrator accounts only; (b) Monitor XPC traffic and process creation for suspicious connections to com.oct4pie.archifyhelper; (c) Review file system access logs for unauthorized deletion or permission changes; (d) Check vendor website (Oct4Pie) for security bulletins and patch availability. No workarounds can fully mitigate this vulnerability without code changes.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today