CVE-2021-20172

Vulnerability

The Netgear Genie installer for macOS, in all known versions up to the time of disclosure, contains a local privilege escalation vulnerability. The installation process includes a postinstall script that runs with root privileges. This script executes the command sudo open -a /Applications/NETGEARGenie.app/Contents/MacOS/LoginItem without verifying the integrity or origin of the LoginItem binary. The script does not perform any checks on the file at that path, allowing a malicious actor with local access to plant a malicious binary or symlink before the installer runs [1].

Exploitation

An attacker with local access to the endpoint where the Netgear Genie installer is about to be run can exploit this vulnerability. The attacker must first ensure that the target file /Applications/NETGEARGenie.app/Contents/MacOS/LoginItem exists before the installer runs. A proof-of-concept exploit uses a loop to continuously create a symlink from that path to an arbitrary executable (e.g., Safari) [1]. When the installer executes the postinstall script, the sudo open -a command launches the attacker-controlled binary with root privileges. No authentication beyond existing local access is required [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code with root privileges on the macOS endpoint. This grants full control over the system, including the ability to install software, modify system files, and access all user data. The vulnerability leads to a complete compromise of confidentiality, integrity, and availability of the affected system [1].

Mitigation

As of the disclosure timeline (December 2021), the vendor had not provided a fix for this issue [1]. No patched version or workaround has been published by Netgear. Users are advised to exercise caution when installing the Netgear Genie software on macOS systems and to ensure that only trusted users have local access to endpoints. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of writing.