CVE-2024-27301
CVSS 3.1 Score 7.3 of 10 (high)
Details
Summary
CVE-2024-27301 is a vulnerability affecting Support App, an open-source application used for managing Apple devices. The vulnerability allows an attacker to exploit a flaw in the postinstall installer script, which executes arbitrary code as root. This is possible because the shebang `#!/bin/zsh` is used, causing the installer to load the file `$HOME/.zshenv` when executed. By adding malicious code to this file, an attacker can escalate privileges on the system. The issue has been addressed in version 2.5.1 Rev 2 of the app, and users are advised to upgrade to mitigate the vulnerability. No known workarounds exist for this vulnerability. The base severity is rated as HIGH, with a CVSS score of 7.3, indicating significant potential danger to organizations that use Support App if left unremediated.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions