Sparkle vulnerabilities

Sparkle, a software update framework for macOS, up to version 2.9.1, has a vulnerability in the Mach connection authentication mechanism. After stage 1 installation completes, new connections to the Mach service are accepted from any local process without code or team ID verification, potentially allowing unauthorized updates.

Vulnerability in Sparkle (software update framework for macOS) versions prior to 2.9.2. Insufficient symlink checking in delta application paths allows an attacker with a stolen EdDSA private key to deliver a malicious .delta file that, after signature verification, enables arbitrary file write outside the destination tree, including at root level when AppInstaller runs as root.

The Sparkle framework includes a helper tool Autoupdate that does not authenticate connecting clients. A local unprivileged attacker can race to connect to the daemon when another app spawns it as root and request installation of a crafted malicious PKG file, resulting in local privilege escalation to root.

The Sparkle framework includes an XPC service Downloader.xpc that is private to the bundled application by default. A local unprivileged attacker can register this service globally, inheriting the application's TCC permissions, and due to lack of client validation copy TCC-protected files to an arbitrary location. Access to other resources requires user interaction. The issue was fixed in version 2.7.2.