CVE-2024-7457
HighSummary
Narzędzie ws.stash.app.mac.daemon.helper zawiera podatność spowodowaną nieprawidłowym użyciem modelu autoryzacji macOS. Zamiast weryfikować referencję autoryzacyjną klienta, narzędzie wywołuje AuthorizationCopyRights() w swoim własnym kontekście z uprawnieniami (root), co skutkuje przyznaniem uprawnień system.preferences.admin niezależnie od uprawnień klienta.
Risk Assessment
Ta wadliwa logika pozwala nieuprzywilejowanym klientom na wykonywanie operacji z uprawnieniami, co może prowadzić do nieautoryzowanych zmian w preferencjach sieciowych systemu. Dodatkowo, brak odpowiednich kontroli podpisywania kodu umożliwia dowolnym procesom wykorzystanie tej luki, co zwiększa ryzyko ataków typu man-in-the-middle.
Recommendation
Zaleca się wprowadzenie poprawek do narzędzia, aby poprawnie weryfikowało referencje autoryzacyjne klientów oraz wdrożenie odpowiednich kontroli podpisywania kodu. Należy również monitorować i ograniczać dostęp do operacji wymagających uprawnień administracyjnych.
Related vulnerabilities
- CVE-2026-100886Critical
A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 version 4.6.1.4-build202604241011. The affected element is an unknown function of the Debug Service component, leading to improper authentication. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-101090Critical
Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the dashboard_host setting is empty, /api/v1/oauth2/{provider} reflects the attacker-supplied Host header into the redirect_uri. An attacker can steal the victim's authorization code and take over the account.
- CVE-2026-101084Critical
obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization to access sensitive backend systems.
- CVE-2026-101065Critical
Obot up to commit d7e6970, when started via the Docker quickstart from README, listens on 0.0.0.0:8080 with authentication disabled. Every request is mapped to a synthetic 'nobody' user with Owner and Admin roles, granting full administrative access. The quickstart also mounts /var/run/docker.sock, giving access to the host's Docker control surface.
- CVE-2026-88773Critical
HTTP Request/Response Smuggling vulnerability in Citrix NetScaler ADC and Gateway due to inconsistent interpretation of HTTP requests.
- CVE-2026-88772CriticalActively exploited
Vulnerability in Citrix NetScaler ADC and Gateway leading to Remote Code Execution or Denial of Service.
- CVE-2026-88771CriticalActively exploited
Improper input validation in Citrix NetScaler ADC and Gateway allows an unauthenticated attacker to execute arbitrary commands.
- CVE-2026-100741Critical
Eval injection vulnerability in hMailServer (versions 6.0.0-6.3.3) allows a remote, unauthenticated attacker to execute arbitrary JScript in the service process with service account privileges. It requires non-default configuration: event scripting enabled, JScript as script language, and an OnClientValidatePassword handler defined. Exploitation uses a password with backslash and apostrophe that is not properly escaped.
- CVE-2026-100721Critical
A vulnerability in vm2 before 3.12.2 allows an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver and `context: 'host'`, guest code can require an allowlisted module and then an absolute path of a non-allowlisted sibling sharing the resolved prefix. This leads to a sandbox escape and arbitrary code execution in the host process.
- CVE-2026-100740Critical
A vulnerability in D-Link DIR-895L A1_102b07 affects the tunnel_set_params function in tunnel.c of the L2TP Control Channel Parser component. Manipulation results in an out-of-bounds write. The attack can be initiated remotely, and the exploit is now public.
Original NVD description (English source)
The ws.stash.app.mac.daemon.helper tool contains a vulnerability caused by an incorrect use of macOS’s authorization model. Instead of validating the client's authorization reference, the helper invokes AuthorizationCopyRights() using its own privileged context (root), effectively authorizing itself rather than the client. As a result, it grants the system.preferences.admin right internally, regardless of the requesting client's privileges. This flawed logic allows unprivileged clients to invoke privileged operations via XPC, including unauthorized changes to system-wide network preferences such as SOCKS, HTTP, and HTTPS proxy settings. The absence of proper code-signing checks further enables arbitrary processes to exploit this flaw, leading to man-in-the-middle (MITM) attacks through traffic redirection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS