CVE-2024-55968 Missing authorization in n/a
Attackers can escalate privileges to root on macOS by exploiting missing client validation in the DTEX Forwarder XPC service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-55968?
CVE-2024-55968 is a high-severity missing authorization vulnerability in n/a, published on 28 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1. The com.dtexsystems.helper service, responsible for handling privileged operations within the macOS DTEX Event Forwarder agent, fails to implement critical client validation during XPC interprocess communication (IPC). Specifically, the service does not verify the code requirements, entitlements, security flags, or version of any client attempting to establish a connection. This lack of proper logic validation allows malicious actors to exploit the service's methods via unauthorized client connections, and escalate privileges to root by abusing the DTConnectionHelperProtocol protocol's submitQuery method over an unauthorized XPC connection.
Weakness: CWE-267
Which versions are affected by CVE-2024-55968?
How do I fix CVE-2024-55968?
No fix has been published for CVE-2024-55968 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-55968 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-55968 exists.
Public exploit code: 2 proofs of concept on GitHub.
Sources
Also known as GHSA-3626-w2c4-wvvc.