PT-2024-36621 · Dtex · Dtex Dec-M

Nullevent + 3 · Published 2024-12-17 · Updated 2025-01-29 · CVE-2024-55968

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DTEX DEC-M (DTEX Forwarder) version 6.1.1

Description An issue was discovered in the com.dtexsystems.helper service, which handles privileged operations within the macOS DTEX Event Forwarder agent. The service fails to implement critical client validation during XPC interprocess communication (IPC), allowing malicious actors to exploit the service's methods via unauthorized client connections. This can lead to privilege escalation to root by abusing the DTConnectionHelperProtocol protocol's submitQuery method over an unauthorized XPC connection.

Recommendations For DTEX DEC-M (DTEX Forwarder) version 6.1.1, consider disabling the com.dtexsystems.helper service until a patch is available to prevent exploitation. Restrict access to the DTConnectionHelperProtocol protocol to minimize the risk of unauthorized connections. Avoid using the submitQuery method in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-267

CWE-798

Related Identifiers

CVE-2024-55968

Affected Products

Dtex Dec-M

References · 7

• 🔥 https://github.com/null-event/CVE-2024-55968 · Exploit
• 🔥 https://github.com/Wi1DN00B/CVE-2024-55968 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-55968 · Security Note
• https://twitter.com/t31m0/status/1869405477727355121 · Twitter Post
• https://twitter.com/CVEnew/status/1884358397518028980 · Twitter Post
• https://t.me/cvedetector/16654 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1869140424050303022 · Twitter Post