Description
A flaw has been found in Magnetism Studios Endurance up to 3.3.0 on macOS. This affects the function loadModuleNamed:WithReply of the file /Applications/Endurance.app/Contents/Library/LaunchServices/com.MagnetismStudios.endurance.helper of the component NSXPC Interface. Executing manipulation can lead to missing authentication. The attack needs to be launched locally. The exploit has been published and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Magnetism Studios | Endurance | 3.0, 3.1, 3.2, 3.3.0 | — |
References
- VDB-325691 | Magnetism Studios Endurance NSXPC com.MagnetismStudios.endurance.helper loadModuleNamed:WithReply missing authentication vdb-entry technical-description
- VDB-325691 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #653994 | Magnetism Studios Endurance 3.3.0 Local Privilege Escalation third-party-advisory
- https://github.com/SwayZGl1tZyyy/n-days/blob/main/Endurance/README.md related
- https://github.com/SwayZGl1tZyyy/n-days/blob/main/Endurance/README.md#proof-of-concept exploit