CVE-2024-27822

HIGH

macOS Sonoma <14.5 - Privilege Escalation

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-27822. PoCs published by Mykola Grymalyuk, h00die, including Metasploit module exploits/osx/local/packagekit_zshenv_privesc.

AI-analyzed exploit summary This Metasploit module exploits CVE-2024-27822, a privilege escalation vulnerability in macOS PackageKit where ZSH installer scripts inherit the user's environment and execute ~/.zshenv with root privileges. The exploit injects a payload into ~/.zshenv that triggers only when EUID=0, then uses a crafted PKG installer to escalate privileges.

Description

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sonoma 14.5. An app may be able to gain root privileges.

Exploits (1)

metasploit WORKING POC MANUAL

by Mykola Grymalyuk, h00die · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/packagekit_zshenv_privesc.rb

View Code ZIP pw:eip

This Metasploit module exploits CVE-2024-27822, a privilege escalation vulnerability in macOS PackageKit where ZSH installer scripts inherit the user's environment and execute ~/.zshenv with root privileges. The exploit injects a payload into ~/.zshenv that triggers only when EUID=0, then uses a crafted PKG installer to escalate privileges.

Classification

Working Poc 100%

Attack Type

Lpe

Complexity

Moderate

Reliability

Racy

Target: macOS PackageKit.framework (versions 14.4 and earlier, 13.6.6 and earlier, 12.7.4 and earlier)

Auth required

Prerequisites: Valid user session on vulnerable macOS system · ZSH installed · User interaction to approve PKG installation and authenticate

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1548 - Abuse Elevation Control Mechanism

mistral-large-3 · analyzed Jul 06, 2026 Full analysis →

References (4)

Core 4

Core References

https://support.apple.com/en-us/120903

Mailing List

http://seclists.org/fulldisclosure/2024/May/12

Vendor Advisory

https://support.apple.com/en-us/HT214106

Vendor Advisory

https://support.apple.com/kb/HT214106

Scores

CVSS v3 7.8

EPSS 0.0146

EPSS Percentile 71.0%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-277

Status published

Products (2)

Apple/macOS < 14.5

apple/macos 14.0 - 14.5

Published May 14, 2024

Tracked Since Feb 18, 2026