Portmaster
Monthly
Safing Portmaster before 2.2.5 exposes a local update endpoint, POST /api/v1/updates/from-url, that is registered with api.PermitAnyone and therefore performs no authorization check, allowing any unprivileged local process to point the updater at an attacker-controlled index URL and bypass both version checks and auto-apply settings. The result is a forced downgrade that can only install releases legitimately signed by Safing, so the practical impact is the reintroduction of previously patched vulnerabilities rather than execution of arbitrary attacker-supplied code, and exploitation requires low-privileged local access (CVSS PR:L) with no user interaction and cannot be performed remotely. Fixed in 2.2.5 by removing the endpoint entirely; no public exploit identified at time of analysis.
Safing Portmaster before 2.2.5 exposes a local update endpoint, POST /api/v1/updates/from-url, that is registered with api.PermitAnyone and therefore performs no authorization check, allowing any unprivileged local process to point the updater at an attacker-controlled index URL and bypass both version checks and auto-apply settings. The result is a forced downgrade that can only install releases legitimately signed by Safing, so the practical impact is the reintroduction of previously patched vulnerabilities rather than execution of arbitrary attacker-supplied code, and exploitation requires low-privileged local access (CVSS PR:L) with no user interaction and cannot be performed remotely. Fixed in 2.2.5 by removing the endpoint entirely; no public exploit identified at time of analysis.