Critical Privilege Escalation Flaw in IPVanish VPN for macOS Exposes Systems to Root Exploits A severe privilege escalation vulnerability has been identified in the IPVanish VPN application for macOS (10.13 and later), allowing any unprivileged local user to execute arbitrary code with root privileges without user interaction. The flaw, discovered by SecureLayer7, bypasses macOS security mechanisms, including code signature verification, posing a high-risk threat to affected systems. ### Vulnerability Details The issue stems from a design flaw in the application’s architecture, which splits operations between a user-space bundle and a privileged helper tool (`com.ipvanish.osx.vpnhelper`) running as root. The helper tool creates an XPC listener but fails to authenticate connecting clients, neglecting to verify the caller’s user ID, entitlements, or bundle identifier. This oversight enables any local process to send crafted XPC messages to the helper. The exploit leverages two critical weaknesses: 1. Arbitrary Code Execution via OpenVPNPath Parameter – The helper tool accepts an unvalidated `OpenVPNPath` parameter from unauthenticated messages, passing it directly to `GCDTask` without path or signature checks. 2. Bypassed Code Signature Verification – A logic error in the `copyHelperTool:error:` method allows unsigned, non-executable scripts to be copied to a root-owned directory, where they are later made executable. Attackers can deploy a malicious script (e.g., `/tmp/ipvanish_exploit.sh`) that the helper tool copies to `/Library/Application Support/com.ipvanish.osx.vpnhelper/` and executes via OpenVPN’s `--up` hook, granting full root access. ### Impact & Indicators of Compromise (IOCs) - CVE ID: Pending - CVSS Score: 8.8 (High) - CWE: CWE-269 (Improper Privilege Management) - Affected Versions: IPVanish VPN for macOS (10.13+) IOCs: - File Paths: - `/tmp/ipvanish_exploit.sh` (initial payload) - `/Library/Application Support/com.ipvanish.osx.vpnhelper/` (destination for root-owned executable) - XPC Service: `com.ipvanish.osx.vpnhelper` (vulnerable helper tool) ### Mitigation Measures SecureLayer7 recommends a comprehensive overhaul of the application’s privilege separation controls, including: - XPC Authentication: Extract audit tokens from connections and verify the caller’s code signature and team ID. - Signature Verification: Enforce code-signing checks on all files, regardless of execute permissions. - Path Whitelisting: Restrict file paths to approved application directories and resolve symlinks. The current implementation’s failure to validate signatures on non-executable files represents a critical logical flaw, requiring immediate remediation.