CyberRota Analysis
AI-GeneratedClearanceKit prior to version 5.0.10 is vulnerable to an attack where an adversary can manipulate the on-disk SQLite policy store (`store.db`) and its associated ECDSA signatures, allowing them to substitute legitimate access policies with malicious ones. This could lead to unauthorized file-system access on macOS systems, posing a significant risk to data integrity and security. Organizations using ClearanceKit should prioritize upgrading to version 5.0.10 to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store (`/Library/Application Support/clearancekit/store.db`) is verified using an ECDSA signature stored in the `data_signatures` table. The signed payload contains only the canonical row content, with no version counter or freshness binding. An attacker who can write `store.db` and the matching `data_signatures` row — feasible during the opfilter-update window when the Endpoint Security filter is offline, or via offline-boot / decrypted-backup scenarios — can substitute a previously-captured legitimately-signed snapshot. opfilter accepts the older snapshot as fully valid on next boot because the existing signatures still verify. Version 5.0.10 patches the issue.