CVE-2015-1130
Apple OS X Authentication Bypass Vulnerability
Description
CVE-2015-1130 is a HIGH severity privilege escalation vulnerability in the Admin Framework of Apple OS X, carrying a CVSS 3.1 score of 7.8. Classified under CWE-59 (Improper Link Resolution Before File Access), the vulnerability exists in the XPC implementation within the Admin Framework. A local attacker with low privileges can exploit this flaw to bypass authentication and obtain administrative privileges on OS X systems prior to version 10.10.3 (Yosemite). The vulnerability was known publicly as "rootpipe" and was added to CISA's Known Exploited Vulnerabilities catalog on February 10, 2022, with a remediation deadline of August 10, 2022. The EPSS score of 21.07% (95.57th percentile) indicates significant exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | mac os x | < 10.10.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html(Broken Link, Mailing List, Vendor Advisory)
- http://www.osvdb.org/120418(Broken Link)
- http://www.securityfocus.com/bid/73982(Broken Link, Exploit, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1032048(Broken Link, Third Party Advisory, VDB Entry)
- https://support.apple.com/HT204659(Vendor Advisory)
- https://www.exploit-db.com/exploits/36692/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1130(US Government Resource)
Weakness Type
CWE-59: Improper Link Resolution Before File Access
CVE-2015-1130 is classified under CWE-59 — Improper Link Resolution Before File Access (Link Following). This weakness occurs when software accesses a file through a symbolic or hard link without adequately verifying that the link points to the intended target, allowing an attacker to redirect file operations to unintended locations.
In the context of Apple OS X's Admin Framework, the XPC (cross-process communication) service responsible for administrative operations does not properly verify the authorization of incoming requests. The "rootpipe" vulnerability allows a local user to bypass the authentication checks in the Admin Framework's XPC service, gaining the ability to execute privileged operations — including writing to protected system directories — without providing administrator credentials.
Impact Analysis
CVE-2015-1130 carries a CVSS 3.1 base score of 7.8 (HIGH) with full impact when exploited locally.
Confidentiality (High): Gaining administrative privileges on OS X provides access to all user data, keychain entries, encrypted volumes, system configuration files, and any sensitive data stored on the machine. The attacker can access other users' files and decrypt protected data.
Integrity (High): With admin access, the attacker can modify system files, install persistent malware, alter security configurations, create new administrator accounts, and tamper with system integrity protections. Root-level access enables installation of kernel extensions and other persistent modifications.
Availability (High): Administrative privileges allow the attacker to shut down or restart the system, disable security features, corrupt the operating system, or render the machine unusable. The attacker can also deploy ransomware with system-level permissions.
Local attack vector: The vulnerability requires local access (AV:L) with low privileges (PR:L), meaning the attacker needs an existing user account on the target Mac. No user interaction is required (UI:N), making exploitation straightforward once local access is obtained.
The EPSS score of 21.07% (95.57th percentile) indicates significant real-world exploitation interest, particularly for post-compromise privilege escalation.
Exploit Maturity
CVE-2015-1130 has a high exploit maturity, publicly known as "rootpipe," with public exploit code and significant security community attention.
Public disclosure as "rootpipe": The vulnerability was discovered by Swedish security researcher Emil Kvarnhammar and publicly disclosed under the name "rootpipe." The disclosure generated significant media attention and security community discussion.
Public exploits: Exploit code is available on Exploit-DB (36692) and SecurityFocus, demonstrating how to escalate privileges from a standard user to root through the Admin Framework XPC vulnerability.
KEV listing: CISA added CVE-2015-1130 to the KEV catalog on February 10, 2022, confirming active exploitation. The remediation deadline was August 10, 2022.
Ransomware association: CISA's KEV does not indicate a direct ransomware association, but privilege escalation on macOS is a valuable capability for any threat actor targeting Apple environments.
macOS security context: This vulnerability highlighted systemic weaknesses in the macOS privilege model and XPC service authorization checks. It contributed to Apple's ongoing efforts to strengthen system integrity protections, including the introduction of System Integrity Protection (SIP) in later OS X versions.
EPSS context: The EPSS score of 21.07% (95.57th percentile) reflects ongoing exploitation interest.
Remediation
-
Update to OS X 10.10.3 or later. Apple addressed CVE-2015-1130 in the OS X 10.10.3 (Yosemite) update released on April 8, 2015. Install the update from Apple Support.
-
Upgrade to a current macOS version. If running OS X Yosemite or earlier, upgrade to a current macOS release that receives active security support. Older OS X versions contain numerous unpatched vulnerabilities.
-
Enable System Integrity Protection (SIP). Ensure SIP is enabled on systems running OS X El Capitan (10.11) or later. SIP provides protection against unauthorized modification of system files even by root users.
-
Restrict local user access. Minimize the number of user accounts on each Mac and ensure standard users cannot obtain physical or remote access to systems containing sensitive data. Implement strong authentication policies.
-
Deploy endpoint detection on macOS. Install macOS-compatible EDR solutions that can detect privilege escalation attempts and unauthorized access to Admin Framework XPC services.
-
Monitor for privilege escalation indicators. Audit system logs for unexpected administrative operations, new administrator accounts, and modifications to system files that may indicate exploitation of this or similar privilege escalation vulnerabilities.
Technical Details
CVE-2015-1130 is a privilege escalation vulnerability in the Admin Framework of Apple OS X, publicly known as "rootpipe." The vulnerability allows a local user to bypass authentication and gain administrative privileges.
Attack vector and prerequisites: Local (AV:L), low complexity (AC:L), requires low privileges (PR:L) — a standard user account on the target Mac. No user interaction required (UI:N).
Exploitation mechanism: The vulnerability resides in the XPC (cross-process communication) service used by the Admin Framework. XPC is Apple's inter-process communication mechanism for privileged operations. The Admin Framework's XPC service fails to properly verify that the connecting process has the necessary authorization to perform administrative actions. A local attacker can send crafted XPC messages that bypass the authentication check, causing the privileged service to execute administrative operations on behalf of the unprivileged user.
Privilege escalation path: Through the vulnerable XPC service, the attacker can write to protected system directories, modify system configuration files, and effectively gain root-equivalent access without knowing the administrator password.
Affected versions: Apple OS X versions prior to 10.10.3. The vulnerability was also present in earlier OS X versions.
Historical note: Apple initially patched the vulnerability only for OS X 10.10.x (Yosemite), leaving earlier versions (10.9 Mavericks and below) permanently vulnerable since they were outside the active support window.
Frequently Asked Questions
What is CVE-2015-1130?
CVE-2015-1130, known as "rootpipe," is a privilege escalation vulnerability in the Admin Framework of Apple OS X. It allows a local user with standard privileges to bypass authentication and gain administrative (root) access through a flaw in the XPC service authorization. The CVSS score is 7.8.
Which macOS versions are affected?
Apple OS X versions prior to 10.10.3 (Yosemite) are affected. Earlier versions like OS X 10.9 (Mavericks) are also vulnerable but did not receive patches, as they were outside Apple's active support window at the time of disclosure.
How do I fix CVE-2015-1130?
Update to OS X 10.10.3 or later. Ideally, upgrade to a current macOS version that receives active security support. Enable System Integrity Protection (SIP) and deploy endpoint detection to monitor for privilege escalation attempts.
How severe is CVE-2015-1130?
CVE-2015-1130 is rated HIGH with a CVSS score of 7.8. Its EPSS score of 21.07% places it in the 95.57th percentile for exploitation probability. CISA confirmed active exploitation through the KEV listing. The vulnerability provides a straightforward path from standard user to root on affected macOS systems.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.