VA-26-251-02

Waves Central local privilege escalation via Improper XPC Client Authentication in macOS

Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement (application identifier and Team ID). A local, unprivileged user can execute code within the vendor-signed process, satisfy the helper's client check, and cause the helper to execute a script with root privileges.