CVE-2024-55968 PoC — DTEX DEC-M 安全漏洞

Source

https://github.com/null-event/CVE-2024-55968

Associated Vulnerability

Title: DTEX DEC-M 安全漏洞 (CVE-2024-55968)
Description:An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1. The com.dtexsystems.helper service, responsible for handling privileged operations within the macOS DTEX Event Forwarder agent, fails to implement critical client validation during XPC interprocess communication (IPC). Specifically, the service does not verify the code requirements, entitlements, security flags, or version of any client attempting to establish a connection. This lack of proper logic validation allows malicious actors to exploit the service's methods via unauthorized client connections, and escalate privileges to root by abusing the DTConnectionHelperProtocol protocol's submitQuery method over an unauthorized XPC connection.

Description

POC for DTEX LPE (CVE-2024-55968)

Readme

# CVE-2024-55968
POC for DTEX LPE (CVE-2024-55968)

## Description

This repo hosts a POC to a critical logic vulnerability in the DTEX Event Reporting Service. DTEX is a unified insider risk management platform.

The macOS EventReportingService was found to not properly validate incoming interprocess connections. Lack of interprocess connection validation allows a malicious actor to execute highly privileged code in the context of the service, which runs with the highest privileges on the operating system.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →