Executive Summary

This vulnerability exists in ClearanceKit versions prior to 5.0.4-beta-1f46165 on macOS. ClearanceKit intercepts file-system access events and enforces access policies per process. However, its Endpoint Security event handler only checked the source path of dual-path file operations against access rules and policies, completely ignoring the destination path.

Because the destination path was not checked, a local process could bypass file-access protections by using operations such as rename, link, copyfile, exchangedata, or clone to place or replace files inside protected directories.

This flaw allowed unauthorized modification or placement of files in protected areas, which was fixed in version 5.0.4-beta-1f46165.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a local attacker or process with limited privileges to bypass file-access protections and place or replace files inside directories that are supposed to be protected.

Such unauthorized file modifications could lead to data integrity issues, unauthorized code execution, or compromise of system security by placing malicious files in sensitive locations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade ClearanceKit to version 5.0.4-beta-1f46165 or later, where the issue has been fixed.

Useful 0 Not Useful 0