Pierluigi Paganini November 29, 2017

macOS High Sierra is plagued by a vulnerability that can be exploited to gain root access to a machine with no password.

An easy exploitable vulnerability in macOS 10.13, aka macOS High Sierra, could be triggered by users to gain admin rights, or log in as root, without a password.

The vulnerability is exploitable via the authentication dialog box in the Apple macOS High Sierra that asks for an administrator’s username and password when the user needs to do specific actions like configure privacy and network settings.

From the user login screen, if the user provides “root” as the username, leave the password box blank, hit “enter” and then click on unlock a few times, the prompt disappears and he gains admin rights.

The attack scenario needs physical access to the machine to log in, once inside the attacker can perform several malicious activities such as install a malware.

Waiting for a fix, users should mitigate the bug not leaving vulnerable macOS High Sierra unattended, nor allowing remote desktop access.

The flaw was publicly disclosed via Twitter by the developer Lemi Orhan Ergan.

You can access it via System Preferences>Users & Groups>Click the lock to make changes. Then use "root" with no password. And try it for several times. Result is unbelievable! pic.twitter.com/m11qrEvECs

— Lemi Orhan Ergin (@lemiorhan) November 28, 2017

With the access to the machine it is possible to disable FileVault encryption that protects the files from being seen or copied.

https://twitter.com/jonp__/status/935607120208199682

Experts noticed that If they have a root account enabled and a password for it set, the trick will not work.

To set the password, type the following command from the Terminal.

sudo passwd -u root

Apple promptly published this guide to enabling the root account and setting a password for it. If you have remote desktop access enabled for VNC, RDP, screen sharing and similar, it can be used to gain admin rights on your machine. Apple will release a patch to address the issue.

Pierluigi Paganini

(Security Affairs – macOS High Sierra, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]