Vulnerabilities > CVE-2023-41036 - Improper Privilege Management vulnerability in Macvim

CVSS 7.8 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

local

low complexity

macvim

CWE-269

NVD

Published: 2023-11-07

Updated: 2024-03-18

Summary

Macvim is a text editor for MacOS. Prior to version 178, Macvim makes use of an insecure interprocess communication (IPC) mechanism which could lead to a privilege escalation. Distributed objects are a concept introduced by Apple which allow one program to vend an interface to another program. What is not made clear in the documentation is that this service can vend this interface to any other program on the machine. The impact of exploitation is a privilege escalation to root - this is likely to affect anyone who is not careful about the software they download and use MacVim to edit files that would require root privileges. Version 178 contains a fix for this issue.

Vulnerable Configurations

Part	Description	Count
Application	Macvim Macvim Macvim 21 Macvim Macvim 22 Macvim Macvim 23 Macvim Macvim 24 Macvim Macvim 25 Macvim Macvim 26 Macvim Macvim 27 Macvim Macvim 28 Macvim Macvim 29 Macvim Macvim 30 Macvim Macvim 31 Macvim Macvim 32 Macvim Macvim 33 Macvim Macvim 34 Macvim Macvim 35 Macvim Macvim 36 Macvim Macvim 37 Macvim Macvim 38 Macvim Macvim 39 Macvim Macvim 40 Macvim Macvim 41 Macvim Macvim 42 Macvim Macvim 43 Macvim Macvim 44 Macvim Macvim 45 Macvim Macvim 46 Macvim Macvim 47 Macvim Macvim 48 Macvim Macvim 49 Macvim Macvim 50 Macvim Macvim 51 Macvim Macvim 52 Macvim Macvim 53 Macvim Macvim 54 Macvim Macvim 55 Macvim Macvim 56 Macvim Macvim 57 Macvim Macvim 58 Macvim Macvim 59 Macvim Macvim 60 Macvim Macvim 61 Macvim Macvim 62 Macvim Macvim 63 Macvim Macvim 64 Macvim Macvim 65 Macvim Macvim 66 Macvim Macvim 67 Macvim Macvim 68 Macvim Macvim 69 Macvim Macvim 70 Macvim Macvim 71 Macvim Macvim 72 Macvim Macvim 73 Macvim Macvim 74 Macvim Macvim 75 Macvim Macvim 76 Macvim Macvim 77 Macvim Macvim 79 Macvim Macvim 80 Macvim Macvim 81 Macvim Macvim 82 Macvim Macvim 83 Macvim Macvim 84 Macvim Macvim 85 Macvim Macvim 86 Macvim Macvim 87 Macvim Macvim 88 Macvim Macvim 89 Macvim Macvim 90 Macvim Macvim 91 Macvim Macvim 92 Macvim Macvim 93 Macvim Macvim 94 Macvim Macvim 95 Macvim Macvim 96 Macvim Macvim 97 Macvim Macvim 98 Macvim Macvim 99 Macvim Macvim 100 Macvim Macvim 101 Macvim Macvim 102 Macvim Macvim 103 Macvim Macvim 104 Macvim Macvim 105 Macvim Macvim 106 Macvim Macvim 107 Macvim Macvim 108 Macvim Macvim 109 Macvim Macvim 110 Macvim Macvim 111 Macvim Macvim 112 Macvim Macvim 113 Macvim Macvim 114 Macvim Macvim 115 Macvim Macvim 116 Macvim Macvim 117 Macvim Macvim 118 Macvim Macvim 119 Macvim Macvim 120 Macvim Macvim 121 Macvim Macvim 122 Macvim Macvim 123 Macvim Macvim 124 Macvim Macvim 125 Macvim Macvim 126 Macvim Macvim 127 Macvim Macvim 128 Macvim Macvim 129 Macvim Macvim 130 Macvim Macvim 131 Macvim Macvim 132 Macvim Macvim 133 Macvim Macvim 134 Macvim Macvim 135 Macvim Macvim 136 Macvim Macvim 137 Macvim Macvim 138 Macvim Macvim 139 Macvim Macvim 140 Macvim Macvim 141 Macvim Macvim 142 Macvim Macvim 143 Macvim Macvim 144 Macvim Macvim 145 Macvim Macvim 146 Macvim Macvim 147 Macvim Macvim 148 Macvim Macvim 149 Macvim Macvim 150 Macvim Macvim 151 Macvim Macvim 152 Macvim Macvim 153 Macvim Macvim 154 Macvim Macvim 155 Macvim Macvim 156 Macvim Macvim 157 Macvim Macvim 158 Macvim Macvim 159 Macvim Macvim 160 Macvim Macvim 161 Macvim Macvim 162 Macvim Macvim 163 Macvim Macvim 164 Macvim Macvim 165 Macvim Macvim 166 Macvim Macvim 167 Macvim Macvim 168 Macvim Macvim 169 Macvim Macvim 170 Macvim Macvim 171 Macvim Macvim 172 Macvim Macvim 173 Macvim Macvim 174 Macvim Macvim 175 Macvim Macvim 176 Macvim Macvim 176.1 Macvim Macvim 177	157

Common Weakness Enumeration (CWE)

CWE-269 - Improper Privilege Management

Common Attack Pattern Enumeration and Classification (CAPEC)

Restful Privilege Elevation
Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References