CVE-2025-70342: Credential Interception via Named Pipe in erase-install

Summary

erase-install prior to v40.4 (commit 2c31239) writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json. On Apple Silicon Macs, admin credentials entered during reinstall/erase operations are written to this predictable, world-writable location. A local unprivileged attacker can create a named pipe (FIFO) at this path to intercept admin credentials in real time.

Affected Versions

• Vulnerable: erase-install <= 40.4
• Fixed: commit 2c31239 (after PR #574)

CVSS 3.1

Score: 7.1 (High)

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Vulnerability Details

Hardcoded Credential Output Path (CWE-732)

File: erase-install.sh

Line 72:

dialog_output="/var/tmp/dialog.json"

Line 124:

"$dialog_bin" "${dialog_args[@]}" ... 2>/dev/null > "$dialog_output"

On Apple Silicon Macs, erase-install prompts the admin for credentials via swiftDialog. The credentials (username + password) are written via shell redirect to /var/tmp/dialog.json - a hardcoded path in a world-writable directory. The script does not check whether this path has been tampered with before writing.

Attack Scenario

1. Unprivileged attacker creates a named pipe (FIFO): mkfifo /tmp/.fifo
2. Attacker creates symlink: ln -s /tmp/.fifo /var/tmp/dialog.json
3. Attacker reads from FIFO (blocks, waiting for data)
4. Admin runs: sudo erase-install.sh --erase
5. Admin enters credentials in swiftDialog prompt
6. Credentials flow through symlink → FIFO → attacker's terminal

This attack requires no special timing or race condition - the attacker simply plants the symlink and waits.

Proof of Concept

Prerequisites

• Apple Silicon Mac (credential prompt only triggers on arm64)
• Any unprivileged local user account

Usage

# Start the listener (as unprivileged user)
python3 poc.py

# Wait for admin to run erase-install with --erase or --reinstall
# Credentials will be printed to stdout when captured

# Cleanup
python3 poc.py --cleanup

See poc.py for full details.

Remediation

• Upgrade erase-install to the version containing commit 2c31239 or later
• The fix uses mktemp to generate a random filename, preventing path prediction:

- dialog_output="/var/tmp/dialog.json"
+ dialog_output=$(/usr/bin/mktemp /var/tmp/dialog.XXX.json)

Timeline

Credit

• cooldadhacking (GitHub)

References

• erase-install PR #574
• Fix commit 2c31239

Disclaimer

This proof of concept is provided for educational and authorized security testing purposes only. Use responsibly and only on systems you own or have explicit permission to test.