CVE-2018-4237

HIGH EXPLOITED

Mac OS X libxpc MITM Privilege Escalation

Title source: metasploit

Exploitation Summary

CVE-2018-4237 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including Metasploit, saelo, including a Metasploit module exploits/osx/local/libxpc_mitm_ssudo.

AI-analyzed exploit summary This Metasploit module exploits CVE-2018-4237, a privilege escalation vulnerability in macOS libxpc (<= 10.13.3). It manipulates the bootstrap port to intercept communication between sudo and opendirectoryd, allowing password validation bypass.

Description

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "libxpc" component. It allows attackers to gain privileges via a crafted app that leverages a logic error.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Metasploit · rubylocalmacos

https://www.exploit-db.com/exploits/45916

View Code ZIP pw:eip

This Metasploit module exploits CVE-2018-4237, a privilege escalation vulnerability in macOS libxpc (<= 10.13.3). It manipulates the bootstrap port to intercept communication between sudo and opendirectoryd, allowing password validation bypass.

Classification

Working Poc 100%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: macOS <= 10.13.3

No auth needed

Prerequisites: Non-root session on vulnerable macOS · Writable directory (default: /tmp)

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1548.003 - Sudo and Sudo Caching

devstral-2 · analyzed Feb 16, 2026 Full analysis →

metasploit WORKING POC EXCELLENT

by saelo · rubypocosx

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/libxpc_mitm_ssudo.rb