{"id":64877,"date":"2025-06-11T05:32:06","date_gmt":"2025-06-11T02:02:06","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2024-9062-apple-archify-local-privilege-escalation-vulnerability\/"},"modified":"2025-06-11T05:32:06","modified_gmt":"2025-06-11T02:02:06","slug":"cve-2024-9062-apple-archify-local-privilege-escalation-vulnerability","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2024-9062-apple-archify-local-privilege-escalation-vulnerability\/","title":{"rendered":"CVE-2024-9062 &#8211; Apple Archify Local Privilege Escalation Vulnerability"},"content":{"rendered":"<p><strong>CVE ID : <\/strong>CVE-2024-9062<br \/>\n<br \/>\n<strong>Published : <\/strong> June 11, 2025, 12:15 a.m. | 47\u00a0minutes ago<br \/>\n<br \/>\n<strong>Description : <\/strong>The Archify application contains a local privilege escalation vulnerability due to insufficient client validation in its privileged helper tool, com.oct4pie.archifyhelper, which is exposed via XPC. Archify follows the &#8220;factored applications&#8221; model, delegating privileged operations\u2014such as arbitrary file deletion and file permission changes\u2014to this helper running as root. However, the helper does not verify the code signature, entitlements, or signing flags of the connecting client. Although macOS provides secure validation mechanisms like auditToken, these are not implemented. As a result, any local process can establish a connection to the helper and invoke privileged functionality, leading to unauthorized execution of actions with root-level privileges.<br \/>\n<br \/>\n<strong>Severity:<\/strong> 7.8 | HIGH<br \/>\n<br \/>\nVisit the link for more details, such as CVSS details, affected products, timeline, and more&#8230;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE ID : CVE-2024-9062 Published : June 11, 2025, 12:15 a.m. | 47\u00a0minutes ago Description : The Archify application contains a local privilege escalation vulnerability due to insufficient client validation in its privileged helper tool, com.oct4pie.archifyhelper, which is exposed via XPC. Archify follows the &#8220;factored applications&#8221; model, delegating privileged operations\u2014such as arbitrary file deletion and &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-64877","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/64877","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=64877"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/64877\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=64877"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=64877"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=64877"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}