CVE-2024-7457

The ws.stash.app.mac.daemon.helper tool contains a vulnerability caused by an incorrect use of macOS’s authorization model. Instead of validating the client's authorization reference, the helper invokes AuthorizationCopyRights() using its own privileged context (root), effectively authorizing itself rather than the client. As a result, it grants the system.preferences.admin right internally, regardless of the requesting client's privileges. This flawed logic allows unprivileged clients to invoke privileged operations via XPC, including unauthorized changes to system-wide network preferences such as SOCKS, HTTP, and HTTPS proxy settings. The absence of proper code-signing checks further enables arbitrary processes to exploit this flaw, leading to man-in-the-middle (MITM) attacks through traffic redirection.

• CWE-863

• https://pentraze.com/

Published

Jun 11, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-7451A vulnerability was found in itsourcecode Placement Manageme…8.7
• CVE-2024-7452A vulnerability was found in itsourcecode Placement Manageme…8.7
• CVE-2024-7453A vulnerability was found in FastAdmin 1.5.0.20240328. It ha…4.8
• CVE-2024-7454A vulnerability, which was classified as critical, has been …9.8
• CVE-2024-7455A vulnerability, which was classified as critical, was found…9.8
• CVE-2024-7456A SQL injection vulnerability exists in the `/api/v1/externa…9.8
• CVE-2024-7458A vulnerability was found in elunez eladmin up to 2.7 and cl…9.8
• CVE-2024-7459A vulnerability was found in OSWAPP Warehouse Inventory Syst…8.8
• CVE-2024-7460A vulnerability was found in OSWAPP Warehouse Inventory Syst…8.8
• CVE-2024-7461A vulnerability was found in ForIP Tecnologia Administração …9.8
• CVE-2024-7462A vulnerability classified as critical has been found in TOT…9.8
• CVE-2024-7463A vulnerability classified as critical was found in TOTOLINK…9.8