CVE-2025-11130 Overview
CVE-2025-11130 is a missing authentication vulnerability [CWE-287] affecting iHongRen pptp-vpn versions 1.0 and 1.0.1 on macOS. The flaw resides in the shouldAcceptNewConnection function within HelpTool/HelperTool.m, a privileged XPC Service component. The function fails to validate incoming XPC client connections, allowing any local process to communicate with the helper tool and invoke its privileged operations. A public exploit is available, and the vendor did not respond to disclosure attempts.
Critical Impact
Local attackers can connect to the privileged XPC helper without authentication, gaining the ability to invoke privileged operations on the host with high impact to confidentiality, integrity, and availability.
Affected Products
- iHongRen pptp-vpn 1.0 on macOS
- iHongRen pptp-vpn 1.0.1 on macOS
- HelpTool/HelperTool.m XPC Service component
Discovery Timeline
- 2025-09-29 - CVE-2025-11130 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11130
Vulnerability Analysis
The vulnerability exists in the privileged helper tool that pptp-vpn installs on macOS to perform operations requiring elevated rights. macOS helper tools communicate with their parent applications through XPC (Cross-Process Communication) services. The helper implements NSXPCListenerDelegate and exposes shouldAcceptNewConnection: to decide whether to accept inbound connections.
In HelperTool.m, this delegate method returns acceptance without performing code-signing or entitlement validation on the connecting client. Any local process can therefore establish an XPC connection and invoke methods on the helper's exported interface. Because the helper runs with elevated privileges, the attacker inherits those privileges for any operation the helper exposes.
The attack requires local access, but no prior authentication or user interaction. A public proof of concept is referenced from the GitHub project overview and tracked in VulDB #326210.
Root Cause
The root cause is missing authentication on a privileged interprocess communication endpoint. Apple's recommended pattern requires verifying the connecting process's audit token, code-signing requirement, and team identifier inside shouldAcceptNewConnection:. The pptp-vpn helper omits these checks, so the listener accepts any local caller regardless of identity.
Attack Vector
An attacker with local code execution on the macOS host enumerates the registered XPC Mach service exposed by the pptp-vpn helper. The attacker creates an NSXPCConnection to that service, sets the same remote object interface defined by the helper, and resumes the connection. Because shouldAcceptNewConnection: returns acceptance unconditionally, the helper exposes its methods to the attacker process. The attacker then invokes privileged helper methods to manipulate VPN configuration, execute helper-side logic, or otherwise act with the helper's privileges.
No code example is reproduced here. Refer to the public references for proof-of-concept details.
Detection Methods for CVE-2025-11130
Indicators of Compromise
- Presence of installed helper binaries associated with pptp-vpn versions 1.0 or 1.0.1 in /Library/PrivilegedHelperTools/.
- Unexpected child processes spawned by the pptp-vpn helper service following local user activity.
- XPC connections to the pptp-vpn helper Mach service originating from processes other than the legitimate pptp-vpn application bundle.
Detection Strategies
- Inventory macOS endpoints for the vulnerable pptp-vpn helper and flag versions 1.0 and 1.0.1.
- Monitor launchd job registrations and SMJobBless installations referencing the pptp-vpn helper label.
- Alert on process executions where the parent is the privileged helper but the requesting client is not the signed pptp-vpn GUI application.
Monitoring Recommendations
- Collect macOS Endpoint Security telemetry (ES_EVENT_TYPE_NOTIFY_EXEC, process lineage) and correlate child processes of helper tools with their expected callers.
- Audit /Library/PrivilegedHelperTools/ and /Library/LaunchDaemons/ for stale or unsigned helpers.
- Track outbound PPTP/GRE traffic changes that correlate with unauthorized configuration modifications by the helper.
How to Mitigate CVE-2025-11130
Immediate Actions Required
- Uninstall pptp-vpn 1.0 and 1.0.1 from all macOS hosts until a fixed release is published.
- Remove the privileged helper from /Library/PrivilegedHelperTools/ and unload the associated launch daemon.
- Restrict local account usage and enforce least privilege on endpoints that previously had the helper installed.
Patch Information
No vendor patch is available. The vendor did not respond to disclosure attempts referenced in VulDB CTI #326210. Organizations should treat the software as unmaintained and replace it with a supported VPN client. PPTP itself is deprecated by Apple; consider migrating to IKEv2, WireGuard, or another modern protocol.
Workarounds
- Remove the pptp-vpn privileged helper and its launch daemon plist, then reboot to clear active XPC listeners.
- Block local users without administrative need from launching the pptp-vpn application via application allowlisting.
- Replace pptp-vpn with a maintained VPN client that performs code-signing validation in shouldAcceptNewConnection:.
# Remove the vulnerable helper and its launch daemon (run as root)
sudo launchctl unload /Library/LaunchDaemons/com.ihongren.pptp-vpn.helper.plist
sudo rm -f /Library/LaunchDaemons/com.ihongren.pptp-vpn.helper.plist
sudo rm -f /Library/PrivilegedHelperTools/com.ihongren.pptp-vpn.helper
sudo rm -rf "/Applications/pptp-vpn.app"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
