usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 14:03:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

system_settings_system_wide_preferences_configure.yaml is missing full path to security binary #85

New Issue
Closed
opened 2026-01-19 18:29:11 +00:00 by michael · 0 comments
michael commented 2026-01-19 18:29:11 +00:00
Owner
Copy Link

Originally created by @RomanTatar-wandera on GitHub.

Originally assigned to: @robertgendler on GitHub.

Summary

system_settings_system_wide_preferences_configure.yaml in sonoma branch is missing full path to security binary

Steps to reproduce

    if [[ $(security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath '//*[contains(text(), "group")]/following-sibling::*[1]/text()' - ) != "admin" ]]; then
      result="0"
    fi

8d3ac525e4/rules/system_settings/system_settings_system_wide_preferences_configure.yaml (L14)

What is the current bug behavior?

Without full path attacker can put earlier into path different security binary
Instead of intended file will be executed mallicious binary
Code execution

What is the expected correct behavior?

On line 14 security -q should be /usr/bin/security -q

Originally created by @RomanTatar-wandera on GitHub. Originally assigned to: @robertgendler on GitHub. ### Summary `system_settings_system_wide_preferences_configure.yaml` in `sonoma` branch is missing full path to `security` binary ### Steps to reproduce ``` if [[ $(security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath '//*[contains(text(), "group")]/following-sibling::*[1]/text()' - ) != "admin" ]]; then result="0" fi ``` https://github.com/usnistgov/macos_security/blob/8d3ac525e4708b89223e11db3535a4fca2a42dd8/rules/system_settings/system_settings_system_wide_preferences_configure.yaml#L14 ### What is the current *bug* behavior? Without full path attacker can put earlier into path different `security` binary Instead of intended file will be executed mallicious binary Code execution ### What is the expected *correct* behavior? On line 14 `security -q` should be `/usr/bin/security -q`
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#85
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?