Archify Applications up to 1.3.1 com.oct4pie.archifyhelper missing authentication

Summaryinfo

A vulnerability was found in Archify Applications up to 1.3.1. It has been rated as critical. Impacted is an unknown function of the component com.oct4pie.archifyhelper. The manipulation leads to missing authentication. This vulnerability is listed as CVE-2024-9062. The attack must be carried out locally. There is no available exploit.

Detailsinfo

A vulnerability was found in Archify Applications up to 1.3.1 and classified as critical. This issue affects an unknown function of the component com.oct4pie.archifyhelper. The manipulation with an unknown input leads to a missing authentication vulnerability. Using CWE to declare the problem leads to CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The Archify application contains a local privilege escalation vulnerability due to insufficient client validation in its privileged helper tool, com.oct4pie.archifyhelper, which is exposed via XPC. Archify follows the "factored applications" model, delegating privileged operations—such as arbitrary file deletion and file permission changes—to this helper running as root. However, the helper does not verify the code signature, entitlements, or signing flags of the connecting client. Although macOS provides secure validation mechanisms like auditToken, these are not implemented. As a result, any local process can establish a connection to the helper and invoke privileged functionality, leading to unauthorized execution of actions with root-level privileges.

The weakness was presented by Carlos Garrido. The identification of this vulnerability is CVE-2024-9062 since 09/20/2024. The exploitation is known to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Archify

Name

• Applications

Version

• 1.3.0
• 1.3.1

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion