Dr. Buho BuhoCleaner Privilege Escalation Vulnerability

A local privilege escalation vulnerability has been identified in Dr. Buho's BuhoCleaner version 1.15.2. This issue arises from an insecure XPC service in the application's privileged helper tool, allowing unprivileged users to execute arbitrary commands as root. The vulnerability is exploited through a PID reuse attack, where the attacker bypasses code signature validation and takes advantage of a time-of-check-time-of-use race condition to gain elevated privileges.

Impact

Exploitation of this vulnerability allows for unauthorized execution of commands with root privileges, potentially leading to complete system compromise.

Reproduction

The vulnerability can be reproduced by establishing an XPC connection to the vulnerable service, bypassing the code signature validation by reusing a process ID, and then injecting malicious commands that are executed as root.

Remediation

Users are advised to update to BuhoCleaner version 1.15.3, available on the Dr. Buho website.