Privileged Action Exploit in Malwarebytes on macOS
CVE-2020-25533
7HIGH
Key Information:
- Vendor
Malwarebytes
- Status
- Vendor
- CVE Published:
- 15 January 2021
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2020-25533?
A vulnerability has been identified in Malwarebytes prior to version 4.0 on macOS, where a malicious application can exploit the launch daemon. The privileged service's failure to properly validate XPC connections—by relying on process identifiers (PIDs) instead of audit tokens—creates an avenue for attackers. Using a race condition alongside crafted execution of posix_spawn, an attacker can manipulate the system to reuse a PID in a way that allows unauthorized privileged actions.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.