null-event/cve-2024-55968POC for DTEX LPE (CVE-2024-55968)
POC for DTEX LPE (CVE-2024-55968)
Affected product: DEC-M (DTEX Forwarder) version 6.1.1. DTEX is a unified insider risk management platform.
Affected component: DEC-M EventReportingService XPC Helper
Attack vector: The DTEX Event Reporting Service was found with a privileged XPC helper that doesn't implement validation. A malicious actor can weaponize this logic vulnerability to locally escalate user privileges on macOS via abusing the DTConnectionHelperProtocol protocol's submitQuery method over an unauthorized XPC connection.
The com.dtexsystems.helper service, responsible for handling privileged operations within the macOS DTEX Event Forwarder agent, fails to implement critical client validation during XPC inter-process communication (IPC). Specifically, the service does not verify the code requirements, entitlements, security flags, or version of any client attempting to establish a connection. This lack of proper logic validation allows malicious actors to exploit the service's methods via unauthorized client connections and escalate privileges to root.
Paul Montgomery (@nullevent) and Waleed Barakat (@WilDN00B), TikTok USDS Red Team
