CleanMyMac X removeKextAtPath privilege escalation vulnerability

Summary

The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with local access could use this vulnerability to modify the running kernel extensions on the system.

Tested Versions

Clean My Mac X 4.04

Product URLs

<https://macpaw.com/cleanmymac&gt;

CVSSv3 Score

7.1 - CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

CWE

CWE-19: Improper Input Validation

Details

CleanMyMac X is an all-in-one cleanup and optimization tool for the Mac operating system. The application is able to scan the system and user directories, looking for unused and leftover files and applications. The applications also markets the ability to help detect and prevent viruses and malware on OS X. The software utilizes a privilege helper tool running as root to get this work done faster. This allows the application to remove and modify system files.

The vulnerability arises in removeKextAtPath functionality of the helper protocol. The code for this function is:

kext = objc_retain(a3);
v6 = objc_retain(a4);
v7 = (CMKextManager *)objc_msgSend(&OBJC_CLASS___CMKextManager, "alloc");
v8 = (CMKextManager *)objc_msgSend(v7, "init");
v9 = (unsigned __int64)-[CMKextManager removeKextAtPath:](v8, "removeKextAtPath:", kext);  [0]

At location [0], a user-supplied argument is passed into the function removeKextAtPath. There is no validation of the calling application. Therefore, any application is able to access this function, and because this is a privileged helper, it runs as root. This crosses a privilege boundary, allowing non-root users to remove kernel extensions running on the system, as well as deleting them from the system directory.

Exploit Proof of Concept

Included with this advisory is an Xcode project and a Python script. The Python script needs an administrator’s password to set up some root files on the system before exploiting these vulnerabilities. The Xcode project contains the proof of concept. Users should be very careful while testing this, as this will remove a kernel extension from the system folder and unload it from the system.

Timeline

2018-11-09 - Vendor Disclosure
2018-12-27 - Vendor Patched
2019-01-02 - Public Release