Executive Summary

This vulnerability in Mosh-Pro on macOS occurs when the "RunAsNode" fuse is enabled. It allows a local attacker with limited (unprivileged) access to execute arbitrary code that inherits the application's TCC (Transparency, Consent, and Control) permissions. This means the attacker can use the permissions previously granted to Mosh-Pro without needing additional user approval, potentially disguising malicious actions as legitimate ones.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow a local attacker to run arbitrary code with the same TCC permissions as Mosh-Pro, potentially accessing resources that the user has previously allowed Mosh-Pro to use. This could lead to unauthorized actions or data access under the guise of the trusted application, increasing the risk of malicious activity on the affected system.

Useful 0 Not Useful 0

Mitigation Strategies

Since the patching status is unknown and the authors did not respond to CNA messages, immediate mitigation steps are not specified. However, as the vulnerability involves local unprivileged access exploiting Mosh-Pro's RunAsNode fuse enabled configuration, it is advisable to restrict local unprivileged user access to systems running Mosh-Pro version 1.3.2 and monitor for suspicious activity related to Mosh-Pro processes. Additionally, consider disabling or limiting the use of the RunAsNode fuse feature if possible until a patch is available.

Useful 0 Not Useful 0