MacPorts PortsCLI Remote Code Execution Vulnerability via Compromised Mirror

A vulnerability exists in the MacPorts package manager for macOS, specifically in the PortsCLI component. When a user runs 'port selfupdate' against a malicious or compromised MacPorts mirror, the mirror can execute arbitrary commands as root on the user's machine. This issue arises because the MacPorts client uses 'rsync' to download update files from the mirror. If the mirror serves a valid, signed archive along with additional crafted files, the client can be tricked into executing commands specified in those files, bypassing signature validation.

Impact

Exploitation of this vulnerability allows for arbitrary command execution as root on the affected machine.

Reproduction

The vulnerability can be reproduced by applying a specific modification to an Rsync server that ignores client-side filter rules. This modified server can then serve a valid 'ports.tar.gz' archive to a MacPorts client using the unfiltered Rsync version, effectively injecting a 'Portfile' that executes commands on the client's system.

Remediation

Users are advised to update MacPorts to the latest version, where this vulnerability has been addressed. Instructions for updating MacPorts can be found on the MacPorts website.