Exam4
Monthly
Local privilege escalation in Extegrity Exam4 on macOS lets any unprivileged local user escalate to full root by abusing command injection in the root-running com.extegrity.LogTool privileged helper, which is reachable over XPC. An attacker with a low-privileged local session (PR:L, AV:L, no user interaction required, UI:N) can send crafted XPC messages that reach [ConsoleLogHelper copyConsoleIntoFileFromStartDate:], where attacker-controlled parameters are passed into a syslog command without sanitization and executed with root privileges via LaunchSynchronous, yielding complete confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8, HIGH). Exploitation requires the helper to be installed, registered, and reachable on the host; remote exploitation is not possible, and no public exploit code was identified at time of analysis.
Local privilege escalation in Extegrity Exam4 on macOS lets any unprivileged local user escalate to full root by abusing command injection in the root-running com.extegrity.LogTool privileged helper, which is reachable over XPC. An attacker with a low-privileged local session (PR:L, AV:L, no user interaction required, UI:N) can send crafted XPC messages that reach [ConsoleLogHelper copyConsoleIntoFileFromStartDate:], where attacker-controlled parameters are passed into a syslog command without sanitization and executed with root privileges via LaunchSynchronous, yielding complete confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8, HIGH). Exploitation requires the helper to be installed, registered, and reachable on the host; remote exploitation is not possible, and no public exploit code was identified at time of analysis.