CVE-2017-15358

A local attacker exploits a race condition in the Charles Proxy Settings suid binary. The attacker creates a symlink to the real binary, then executes it with the `--self-repair` flag. Because the binary is already root+suid, no password dialog is shown. During the race window between execution and the code path that sets root+suid permissions, the attacker replaces the symlink with a malicious payload. The binary then applies root+suid permissions to the attacker's payload instead of itself, granting the attacker a root shell [ref_id=1].

The vulnerable suid binary is located at `/Applications/Charles.app/Contents/Resources/Charles Proxy Settings`. The binary supports a `--self-repair` option that re-sets root+suid permissions on itself. The flaw is that the binary does not validate the path to itself; it uses a simple API call to get the path at the time it was invoked, allowing a race window where the path can be replaced with a malicious payload [ref_id=1].

The issue was fixed in Charles 4.2.1 released in November 2017 [ref_id=1]. The advisory does not include a patch diff, but the fix presumably validates the binary's own path before applying suid+root permissions, closing the race window that allowed an attacker to swap the file underneath the running binary [ref_id=1].

The public exploit (https://www.exploit-db.com/exploits/45107/) provides a bash script that compiles a small C payload (setuid(0); execl("/bin/bash",...)), creates a symlink to the real Charles binary, launches it with `--self-repair`, replaces the symlink with the compiled payload, and polls until the payload receives root permissions, then executes it to spawn a root shell [ref_id=1].