Executive Summary

This vulnerability in Mihomo Party for macOS allows a local attacker to exploit an insecurely permissioned UNIX socket created by the application. The socket is world-readable and writable and accepts unauthenticated HTTP requests. This enables any local user to connect to the socket and modify system-wide proxy settings, potentially redirecting network traffic through a malicious server. [1]

Useful 0 Not Useful 0

Impact Analysis

Exploiting this vulnerability can allow an attacker to redirect all system network traffic through a malicious server they control. This can lead to man-in-the-middle (MiTM) attacks, enabling interception, manipulation, or exfiltration of sensitive data transmitted over the network. [1]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking for the presence of the UNIX socket `/tmp/mihomo-party-helper.sock` and inspecting its permissions. Use the command `ls -l /tmp/mihomo-party-helper.sock` to see if the socket exists and if it has world-readable and writable permissions. Additionally, monitoring for unauthorized changes to system-wide proxy settings or unusual network traffic redirection may indicate exploitation. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include removing or restricting access to the insecure UNIX socket `/tmp/mihomo-party-helper.sock` by changing its permissions to limit access only to trusted users. Updating Mihomo Party to a version later than 1.8.1 where this vulnerability is fixed is recommended. Additionally, monitor and restrict local user access to prevent unauthorized modification of system proxy settings. [1]

Useful 0 Not Useful 0