ClearanceKit File Operation Bypass

ClearanceKit 4.1 and earlier for macOS allows local authenticated users to completely bypass configured file access policies via seven unmonitored file operation event types. The opfilter Endpoint Security extension only intercepted ES_EVENT_TYPE_AUTH_OPEN events, enabling processes to perform rename, unlink, and five other file operations without policy enforcement or denial logging. Version 4.2 branch contains the fix via commit a3d1733. No public exploit identified at time of analysis, but exploitation requires only local access with low privileges (CVSS PR:L) and no special complexity.

Local authenticated attackers can bypass file access policies in ClearanceKit (macOS system extension) versions prior to 4.2.4 by using specific file operation event types (ES_EVENT_TYPE_AUTH_EXCHANGEDATA and ES_EVENT_TYPE_AUTH_CLONE) that were not intercepted by the opfilter enforcement mechanism. This policy bypass allows unauthorized file access, modification, and data exfiltration despite configured access controls. EPSS exploitation probability is minimal (0.01%, 2nd percentile) and no active exploitation or public POC has been identified. Patch available in version 4.2.4 via commit 6181c4a, requiring system extension reactivation.