CVE-2018-4045

Vulnerability

The helper service of Clean My Mac X version 4.04 contains a privilege escalation vulnerability due to improper input validation in the securelyRemoveItemAtPath function of the helper protocol [1]. The function passes a user-supplied argument directly to securelyRemoveFileAtPath:error: without any validation of the calling application. Because the helper runs as root, any local process can invoke this function, enabling arbitrary file deletion on the system [1].

Exploitation

An attacker with local access—no authentication or user interaction required—can call the exposed helper function with any path argument [1]. The attacker only needs to craft an application or script that sends the securelyRemoveItemAtPath message to the helper service; no administrator password is needed to trigger the vulnerability itself (although the provided proof-of-concept uses an admin password to set up test root files) [1].

Impact

Successful exploitation allows a non-root user to delete any file on the filesystem as root, resulting in high integrity impact. The helper’s root privilege context means the attacker can remove system files, configuration files, or user data, potentially rendering the system unstable or unusable [1]. Confidentiality and availability are not directly affected per the CVSS vector [1].

Mitigation

MacPaw patched this vulnerability on 2018-12-27, per the disclosure timeline [1]. Users should update to Clean My Mac X version 4.05 or later. No other workarounds are documented if an update is not applied [1].