CVE-2024-55968: DTEX DEC-M Privilege Escalation Vulnerability

CVE-2024-55968 Overview

CVE-2024-55968 is a local privilege escalation vulnerability in DTEX DEC-M (DTEX Forwarder) version 6.1.1 on macOS. The com.dtexsystems.helper service handles privileged operations for the DTEX Event Forwarder agent. The service fails to validate clients during XPC interprocess communication (IPC). It does not check code requirements, entitlements, security flags, or version information for connecting clients. An attacker can abuse the submitQuery method of the DTConnectionHelperProtocol protocol over an unauthorized XPC connection to execute operations as root.

Critical Impact
Local attackers with low privileges can escalate to root on macOS endpoints running DTEX Forwarder 6.1.1 by connecting to an unauthenticated privileged helper service.

Affected Products

DTEX DEC-M (DTEX Forwarder) 6.1.1 for macOS
com.dtexsystems.helper privileged helper service
Deployments exposing the DTConnectionHelperProtocol XPC interface

Discovery Timeline

2025-01-28 - CVE-2024-55968 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55968

Vulnerability Analysis

The vulnerability is a privilege management flaw [CWE-267] in the DTEX Forwarder privileged helper on macOS. Privileged helper tools on macOS receive requests from user-space clients through XPC. The helper must verify that each connecting client is a trusted, signed binary before executing privileged actions. The com.dtexsystems.helper service skips this validation entirely. Any local process can open an XPC connection to the helper and invoke its exported methods. Because the helper runs as root and exposes the submitQuery method of DTConnectionHelperProtocol, an attacker can invoke privileged operations from an unprivileged process. This converts a low-privilege local foothold into full root access on the host.

Root Cause

The root cause is missing client identity validation on incoming XPC connections. The helper does not call SecCodeCheckValidity or evaluate SecRequirement code signing predicates against the peer connection. It also does not inspect the auditToken, entitlements, or signing identifier of the client. Without these checks, the helper trusts any process that connects to its Mach service.

Attack Vector

An attacker with a local user account on a macOS system running the vulnerable agent writes a small client that opens an NSXPCConnection to the com.dtexsystems.helper Mach service. The client sets the remote object interface to DTConnectionHelperProtocol and invokes submitQuery with attacker-controlled arguments. The helper executes the requested operation with root privileges. Public proof-of-concept implementations are available in the Wi1DN00B PoC repository and the null-event PoC repository.

Detection Methods for CVE-2024-55968

Indicators of Compromise

Unexpected child processes spawned by the com.dtexsystems.helper process running as root
New or unsigned binaries establishing XPC connections to the com.dtexsystems.helper Mach service
Unusual invocations of submitQuery originating from non-DTEX signed processes
File writes or command execution under /Library/PrivilegedHelperTools/ from unexpected callers

Detection Strategies

Monitor macOS Endpoint Security events (ES_EVENT_TYPE_NOTIFY_EXEC) for processes launched by the DTEX helper with parents that are not DTEX-signed binaries.
Alert on NSXPCConnection traffic to com.dtexsystems.helper from processes lacking the expected DTEX code signing identifier.
Correlate local user shell activity with subsequent root-level process creation on hosts running DTEX Forwarder 6.1.1.

Monitoring Recommendations

Inventory endpoints running DTEX DEC-M 6.1.1 and prioritize them for privileged process telemetry collection.
Track code signing validation results for processes interacting with privileged helper tools under /Library/PrivilegedHelperTools/.
Baseline legitimate DTEX agent behavior and alert on deviations such as new command invocations or unexpected file system writes as root.

How to Mitigate CVE-2024-55968

Immediate Actions Required

Upgrade DTEX Forwarder to a version released after 6.1.1 that enforces XPC client validation.
Restrict local logon on macOS hosts running the vulnerable agent to trusted administrators until patched.
Audit /Library/PrivilegedHelperTools/ for the presence of com.dtexsystems.helper on version 6.1.1 and flag affected hosts.

Patch Information

No vendor advisory URL is included in the NVD record for CVE-2024-55968. Contact DTEX Systems for a fixed release of the DEC-M Forwarder and confirm that the updated helper validates client code signing, entitlements, and version before servicing XPC requests.

Workarounds

Remove or disable the com.dtexsystems.helper privileged helper on affected macOS hosts if operational requirements permit.
Enforce application allowlisting so only DTEX-signed processes can execute on managed macOS endpoints.
Limit interactive and remote local access to macOS systems running DTEX Forwarder 6.1.1 until an updated build is deployed.

bash

# Identify affected macOS endpoints
sudo ls -l /Library/PrivilegedHelperTools/ | grep dtexsystems
codesign -dvvv /Library/PrivilegedHelperTools/com.dtexsystems.helper

# Remove the vulnerable helper (only after coordinating with DTEX)
sudo launchctl unload /Library/LaunchDaemons/com.dtexsystems.helper.plist
sudo rm /Library/PrivilegedHelperTools/com.dtexsystems.helper