{"vulnerability": "cve-2024-2782", "sightings": [{"uuid": "263395ee-01d9-4a70-9797-317f0333399f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27821", "type": "seen", "source": "https://bsky.app/profile/snoolie.gay/post/3lhkxe3vy2c22", "content": "", "creation_timestamp": "2025-02-07T06:18:36.500509Z"}, {"uuid": "0799dd5b-b1c1-40de-89f8-dd7cf0421644", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27821", "type": "seen", "source": "https://bsky.app/profile/snoolie.gay/post/3lhrvypj3u22k", "content": "", "creation_timestamp": "2025-02-10T00:42:58.805637Z"}, {"uuid": "eed181dc-b2b2-4058-b9bc-d72f62d11f33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-2782", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lvom743f4v2n", "content": "", "creation_timestamp": "2025-08-05T21:02:21.472422Z"}, {"uuid": "35379781-1763-4f33-8329-7b88fd2c63be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-2782", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lyy7rudfgp2n", "content": "", "creation_timestamp": "2025-09-16T21:02:31.236009Z"}, {"uuid": "36036f29-6a0d-4454-b177-77eda7150f9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27821", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/9060", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aWriteup and PoC of CVE-2024-27821, for education purposes.\nURL\uff1ahttps://github.com/0xilis/CVE-2024-27821\n\n\u6807\u7b7e\uff1a#CVE-2024", "creation_timestamp": "2024-11-17T20:58:45.000000Z"}, {"uuid": "11112a09-42a0-4646-9c49-44da15a15a45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27823", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/8893", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-27823\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: A race condition was addressed with improved locking. This issue is fixed in macOS Sonoma 14.5, iOS 16.7.8 and iPadOS 16.7.8, macOS Ventura 13.6.7, watchOS 10.5, visionOS 1.3, tvOS 17.5, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5. An attacker in a privileged network position may be able to spoof network packets.\n\ud83d\udccf Published: 2024-07-29T22:16:47.880Z\n\ud83d\udccf Modified: 2025-03-26T16:12:56.174Z\n\ud83d\udd17 References:\n1. https://support.apple.com/en-us/HT214101\n2. https://support.apple.com/en-us/HT214100\n3. https://support.apple.com/en-us/HT214107\n4. https://support.apple.com/en-us/HT214106\n5. https://support.apple.com/en-us/HT214105\n6. https://support.apple.com/en-us/HT214104\n7. https://support.apple.com/en-us/HT214123\n8. https://support.apple.com/en-us/HT214102\n9. https://support.apple.com/kb/HT214107\n10. https://support.apple.com/kb/HT214102\n11. https://support.apple.com/kb/HT214104\n12. https://support.apple.com/kb/HT214105\n13. https://support.apple.com/kb/HT214100\n14. https://support.apple.com/kb/HT214106\n15. https://support.apple.com/kb/HT214101\n16. http://seclists.org/fulldisclosure/2024/Jul/23", "creation_timestamp": "2025-03-26T16:25:30.000000Z"}, {"uuid": "3ca5dfc7-f0f2-40cf-818a-db5f0a3ca635", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27822", "type": "published-proof-of-concept", "source": "https://t.me/orderofsixangles/2316", "content": "CVE-2024-27822: macOS PackageKit Privilege Escalation\n\nhttps://khronokernel.com/macos/2024/06/03/CVE-2024-27822.html", "creation_timestamp": "2024-06-04T04:17:47.000000Z"}, {"uuid": "77252208-2989-4698-8fbd-a632132cbbe0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-2782", "type": "published-proof-of-concept", "source": "Telegram/k9l6whAFym9ZbJh5WMNbuyJuC8dcnnMOM_Gxizovh2wCYo8", "content": "", "creation_timestamp": "2025-08-03T09:00:06.000000Z"}, {"uuid": "4be6336b-411e-4745-8e60-e25e070dda8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27821", "type": "published-proof-of-concept", "source": "https://t.me/CyberBulletin/1555", "content": "\u26a1\ufe0fWorkflowKit Race Vulnerability (CVE-2024-27821): Researcher Reveals Exploit that Let Malicious Apps Hijack Shortcuts.\n\n#CyberBulletin", "creation_timestamp": "2024-11-21T11:22:57.000000Z"}, {"uuid": "6b530dd4-5569-4ac5-9d31-17ea9225b403", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27822", "type": "seen", "source": "https://t.me/Blackhat_Officials/1036", "content": "CVE-2024-27822: macOS PackageKit Privilege Escalation\nhttps://ift.tt/pHlLd1J\n\nDiscuss on Reddit: https://ift.tt/a18WN2l\n@blueteamalerts", "creation_timestamp": "2024-06-08T19:45:07.000000Z"}, {"uuid": "3d358f76-f0d7-4fdb-a355-a0c5097f6033", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27822", "type": "published-proof-of-concept", "source": "https://t.me/sycebrex/163", "content": "\u041f\u043e\u043a \u0438 \u043c\u0430\u043a\u0438\n\n\u0412\u0447\u0435\u0440\u0430 \u043e\u0434\u0438\u043d \u0440\u0435\u0441\u0435\u0447\u0435\u0440 \u043f\u043e \u0438\u043c\u0435\u043d\u0438 Mykola Grymalyuk \u0437\u0430\u0440\u0435\u043b\u0438\u0437\u0438\u043b PoC (proof of concept) \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434 CVE-2024-27822 - \u043f\u043e\u0434\u043d\u044f\u0442\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e root (\u043d\u0430\u0438\u0432\u044b\u0441\u0448\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0447\u0435\u0440\u0435\u0437 Zsh-\u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0442\u043e\u0440, \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0430 \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043f\u0440\u0435\u0434\u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0430 \u0432 MacOS. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u044d\u043b\u0435\u0433\u0430\u043d\u0442\u043d\u0430\u044f \u0438 \u043f\u0440\u043e\u0441\u0442\u0430\u044f: \u042d\u043f\u043b\u043e\u0432\u0441\u043a\u0438\u0439 \nInstaller.app/PackageKit.framework\n \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438, \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0435 \u0432 PKG, \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root \u0432 \u0441\u0440\u0435\u0434\u0435 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441 \u043d\u0438\u0437\u043a\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438. \u042d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u0448\u0435\u0431\u0430\u043d\u0433\u0438 (#!) \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u0432\u043e\u044e \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u0443\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u043b\u043e\u0433\u0438\u043a\u0443: \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, #!/bin/zsh \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0444\u0430\u0439\u043b .zshenv \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u0422\u0430\u043a\u043e\u0439 \u0444\u0438\u043d\u0442 \u0443\u0448\u0430\u043c\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0437\u0430\u0441\u0443\u043d\u0443\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0432 \u0444\u0430\u0439\u043b .zshenv, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0437\u0430\u0442\u0435\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u0441\u044f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root, \u043f\u0440\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0436\u0435\u0440\u0442\u0432\u043e\u0439 PKG \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 ZSH. \u042d\u0444\u0444\u0435\u043a\u0442\u043d\u043e, \u044d\u043b\u0435\u0433\u0430\u043d\u0442\u043d\u043e \u0438 \u0447\u0435\u0440\u0442\u043e\u0432\u0441\u043a\u0438 \u043f\u0440\u043e\u0441\u0442\u043e! \u0418 \u0433\u0434\u0435-\u0442\u043e \u043e\u043f\u044f\u0442\u044c \u043c\u0430\u044f\u0447\u0438\u0442 \u0430\u0442\u0430\u043a\u0430 \u0447\u0435\u0440\u0435\u0437 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u043f\u043e\u0441\u0442\u0430\u0432\u043e\u043a \ud83d\ude43\n\n\u0412\u0430\u0436\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442! \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 MDM (Mobile Device Management) \u0438 Munki, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u043d\u0438 \u0441\u043e\u0437\u0434\u0430\u044e\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root.\n\n\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434 \u043d\u0430\u0448\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 (\u0421\u0435\u0440\u0435\u0433\u0430 \u043f\u0440\u0438\u0432\u0435\u0442) \u043d\u0430\u0445\u043e\u0434\u0438\u043b\u0430 \u043f\u043e\u0445\u043e\u0436\u0438\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043e\u0434\u0438\u043d \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0439 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Flexera, \u043a\u043e\u0433\u0434\u0430 \u0432 \u0444\u0430\u0439\u043b\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043e\u0431\u044b\u0447\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043f\u0440\u043e\u043f\u0438\u0441\u0430\u0442\u044c \u0441\u0432\u043e\u0439 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0442\u043e\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u0441\u044f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 SYSTEM. \u0411\u043e\u043d\u0443\u0441\u043e\u043c \u0435\u0449\u0435 \u043d\u0430\u0448\u043b\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0439 DoS, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b \u043a\u0430\u043a \u0440\u0430\u0437 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439. \u041d\u043e \u0432\u0435\u043d\u0434\u043e\u0440 \u0442\u043e\u0433\u0434\u0430 \u0441\u043a\u0430\u0437\u0430\u043b \"\u042d\u0442\u043e \u043d\u0435 \u0431\u0430\u0433, \u0430 \u0444\u0438\u0447\u0430\", \u043e\u0442\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0438 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c CVE :)", "creation_timestamp": "2024-06-04T17:02:16.000000Z"}, {"uuid": "995f31e5-5432-468b-aed7-b46118b6ea41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27822", "type": "published-proof-of-concept", "source": "https://t.me/HackingInsights/1529", "content": "\u200amacOS Root Access Exploit: PoC Code for CVE-2024-27822 Released\n\nhttps://securityonline.info/macos-root-access-exploit-poc-code-for-cve-2024-27822-released/", "creation_timestamp": "2024-06-04T15:42:49.000000Z"}, {"uuid": "ad7bea35-6505-430a-82db-8ca179b2540c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27822", "type": "seen", "source": "https://t.me/darkcommunityofficial/935", "content": "CVE-2024-27822 macOS PackageKit\n*\nLPE\n*\n\u0414\u043b\u044f \u0432\u0435\u0440\u0441\u0438\u0439:\n    macOS 14.5 Beta 1 (23F5049f) and older\n    macOS 13.6.6 (22G630) and older\n    macOS 12.7.4 (21H1123) and older\n    Any version of macOS 11 or older\n*\nwriteUp\n*\nexploit\n\n#macos #lpe", "creation_timestamp": "2024-06-06T21:02:17.000000Z"}, {"uuid": "867a70bb-bbf5-475b-9983-2212a8fcf568", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27822", "type": "published-proof-of-concept", "source": "Telegram/kk8UfhFwmY5fCWc2ol4Wfv6GNmAscGhX1y7IkyBsp1-AehM", "content": "", "creation_timestamp": "2024-08-22T10:54:43.000000Z"}, {"uuid": "bd2b7d01-51e0-44ba-84c3-6263da6f76f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27822", "type": "seen", "source": "https://t.me/proxy_bar/2113", "content": "CVE-2024-27822 macOS PackageKit\n*\nLPE\n*\n\u0414\u043b\u044f \u0432\u0435\u0440\u0441\u0438\u0439:\n    macOS 14.5 Beta 1 (23F5049f) and older\n    macOS 13.6.6 (22G630) and older\n    macOS 12.7.4 (21H1123) and older\n    Any version of macOS 11 or older\n*\nwriteUp\n*\nexploit\n\n#macos #lpe", "creation_timestamp": "2024-06-06T17:58:06.000000Z"}, {"uuid": "7136731d-cb58-4a61-9500-3eae32e77cac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27822", "type": "published-proof-of-concept", "source": "Telegram/M7RCV34qSIRaRqL77WUnV045chYrL-A5LYoCAz6hN06LaCQ", "content": "", "creation_timestamp": "2024-07-02T07:14:04.000000Z"}, {"uuid": "a7b430a3-b698-47bd-b787-2365ac6327b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27821", "type": "published-proof-of-concept", "source": "https://t.me/CyberBulletin/26533", "content": "\u26a1\ufe0fWorkflowKit Race Vulnerability (CVE-2024-27821): Researcher Reveals Exploit that Let Malicious Apps Hijack Shortcuts.\n\n#CyberBulletin", "creation_timestamp": "2024-11-21T11:22:57.000000Z"}, {"uuid": "98b6ce9c-3603-4dcc-bc5d-7d156022fd5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27822", "type": "published-proof-of-concept", "source": "https://t.me/CNArsenal/2592", "content": "https://khronokernel.com/macos/2024/06/03/CVE-2024-27822.html\n\nCVE-2024-27822: macOS PackageKit Privilege Escalation\n#\u5206\u6790", "creation_timestamp": "2024-06-07T03:43:05.000000Z"}, {"uuid": "a8717694-777f-41ac-ad98-7202b0b50152", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27822", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/10635", "content": "#exploit\n1. CVE-2024-27822:\nmacOS PackageKit Privilege Escalation\nhttps://khronokernel.com/macos/2024/06/03/CVE-2024-27822.html\n\n2. CVE-2024-27348:\nApache HugeGraph Server RCE\nhttps://github.com/kljunowsky/CVE-2024-27348\nhttps://github.com/Zeyad-Azima/CVE-2024-27348\n\n3. CVE-2024-34331:\nParallels Repack Privilege Escalation\nhttps://khronokernel.com/macos/2024/05/30/CVE-2024-34331.html", "creation_timestamp": "2024-07-17T19:40:43.000000Z"}, {"uuid": "3d63c120-2ef9-49d7-8411-43c31d77c63d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27822", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/packagekit_zshenv_privesc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Mykola Grymalyuk\", \"h00die\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits CVE-2024-27822, a vulnerability in macOS\\n          PackageKit.framework where PKG installer scripts using a ZSH shebang\\n          (#!/bin/zsh) are executed as root while inheriting the installing user's\\n          environment. This causes ZSH to load the user's ~/.zshenv with root\\n          privileges before the installer script body runs.\\n\\n          The module injects a payload into ~/.zshenv that only fires when EUID is 0,\\n          uploads a minimal PKG (from data/exploits/CVE-2024-27822/template.pkg) whose\\n          install script uses a #!/bin/zsh shebang, and opens it with Installer.app.\\n          When the user approves the installation dialog and authenticates, PackageKit\\n          runs the install script as root. ZSH sources ~/.zshenv before the script body\\n          executes, so the payload fires with root privileges. The original ~/.zshenv\\n          content is restored immediately after the payload runs.\\n\\n          Affected: macOS 14.4 and earlier, 13.6.6 and earlier, 12.7.4 and earlier,\\n          and all macOS 11 and older releases.\\n          Fixed in: macOS 14.5, 13.6.7, 12.7.5.\", \"disclosure_date\": \"2024-06-03\", \"fullname\": \"exploit/osx/local/packagekit_zshenv_privesc\", \"is_install_path\": true, \"mod_time\": \"2026-07-03 18:58:13 +0000\", \"name\": \"macOS PackageKit ZSH Environment Privilege Escalation\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"event-dependent\"], \"SideEffects\": [\"artifacts-on-disk\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/osx/local/packagekit_zshenv_privesc.rb\", \"platform\": \"OSX,Unix\", \"post_auth\": false, \"rank\": 0, \"ref_name\": \"osx/local/packagekit_zshenv_privesc\", \"references\": [\"CVE-2024-27822\", \"URL-https://khronokernel.com/macos/2024/06/03/CVE-2024-27822.html\", \"ATT&CK-T1068\", \"ATT&CK-T1546.004\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"macOS\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-07-07T06:54:55.838358Z"}, {"uuid": "c50d6773-484b-4d68-9858-bc3d7e0a07c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27822", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/packagekit_zshenv_privesc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Mykola Grymalyuk\", \"h00die\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits CVE-2024-27822, a vulnerability in macOS\\n          PackageKit.framework where PKG installer scripts using a ZSH shebang\\n          (#!/bin/zsh) are executed as root while inheriting the installing user's\\n          environment. This causes ZSH to load the user's ~/.zshenv with root\\n          privileges before the installer script body runs.\\n\\n          The module injects a payload into ~/.zshenv that only fires when EUID is 0,\\n          uploads a minimal PKG (from data/exploits/CVE-2024-27822/template.pkg) whose\\n          install script uses a #!/bin/zsh shebang, and opens it with Installer.app.\\n          When the user approves the installation dialog and authenticates, PackageKit\\n          runs the install script as root. ZSH sources ~/.zshenv before the script body\\n          executes, so the payload fires with root privileges. The original ~/.zshenv\\n          content is restored immediately after the payload runs.\\n\\n          Affected: macOS 14.4 and earlier, 13.6.6 and earlier, 12.7.4 and earlier,\\n          and all macOS 11 and older releases.\\n          Fixed in: macOS 14.5, 13.6.7, 12.7.5.\", \"disclosure_date\": \"2024-06-03\", \"fullname\": \"exploit/osx/local/packagekit_zshenv_privesc\", \"is_install_path\": true, \"mod_time\": \"2026-07-03 18:58:13 +0000\", \"name\": \"macOS PackageKit ZSH Environment Privilege Escalation\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"event-dependent\"], \"SideEffects\": [\"artifacts-on-disk\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/osx/local/packagekit_zshenv_privesc.rb\", \"platform\": \"OSX,Unix\", \"post_auth\": false, \"rank\": 0, \"ref_name\": \"osx/local/packagekit_zshenv_privesc\", \"references\": [\"CVE-2024-27822\", \"URL-https://khronokernel.com/macos/2024/06/03/CVE-2024-27822.html\", \"ATT&CK-T1068\", \"ATT&CK-T1546.004\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"macOS\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-07-09T14:03:41.738877Z"}, {"uuid": "b5476e1a-1fb7-4374-a98a-d1ba05802dc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27822", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqdjfcsjhg2o", "content": "CVE-2026-41264 and CVE-2024-27822: Flawed Protections Expose Real Threats #CVE2026 #CVE2024 #CyberSecurity", "creation_timestamp": "2026-07-11T01:33:03.477050Z"}, {"uuid": "4b5a81ec-67b6-40a9-9fdc-3c5a70061cca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27822", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqdjfgcx4g2o", "content": "CVE-2024-27822 and CVE-2026-41264 Expose Flaws in FlowiseAI and macOS \u2013 Who's Counting the Costs? #CVE2024 #CVE2026 #FlowiseAI", "creation_timestamp": "2026-07-11T01:33:07.135260Z"}, {"uuid": "93189ce2-d76c-4250-b3f5-beea2f62ab11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-27822", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqdjfr3eje2p", "content": "CVE-2024-27822: Is the macOS PackageKit Vulnerability Overstated Risk? #CVE202427822 #macOS #PackageKit", "creation_timestamp": "2026-07-11T01:33:20.814157Z"}]}