CVE-2025-61228: Shirt Pocket SuperDuper! RCE Vulnerability

CVE-2025-61228 Overview

CVE-2025-61228 is a high-severity local code execution vulnerability affecting Shirt Pocket SuperDuper!, a popular macOS backup and cloning application. The vulnerability exists in the software update mechanism, allowing a local attacker to execute arbitrary code on the target system. This flaw is classified under CWE-494 (Download of Code Without Integrity Check), indicating that the application fails to properly verify the authenticity or integrity of software updates before execution.

The vulnerability carries a CVSS 3.1 score of 7.8, reflecting the significant impact on confidentiality, integrity, and availability when successfully exploited. With an EPSS score of 0.007% (43rd percentile), the probability of active exploitation in the wild remains relatively low but should not be disregarded.

Critical Impact

Local attackers can exploit the insecure software update mechanism to execute arbitrary code with the privileges of the application, potentially leading to complete system compromise on affected macOS systems.

Affected Products

• Shirt Pocket SuperDuper! version 3.10 and earlier
• All macOS systems running vulnerable SuperDuper! versions
• Systems with automatic update mechanisms enabled

Discovery Timeline

• 2025-12-01 - CVE-2025-61228 published to NVD
• 2025-12-05 - Last updated in NVD database

Technical Details for CVE-2025-61228

Vulnerability Analysis

The vulnerability resides in SuperDuper!'s software update mechanism. According to CWE-494, the application downloads code (software updates) without properly verifying the integrity or authenticity of the downloaded content. This creates an opportunity for attackers to inject malicious code during the update process.

The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates:

• Attack Vector (AV:L): Local access is required
• Attack Complexity (AC:L): Low complexity to exploit
• Privileges Required (PR:L): Low privileges needed
• User Interaction (UI:N): No user interaction required
• Impact: High impact on Confidentiality, Integrity, and Availability

Root Cause

The root cause stems from inadequate integrity verification during the software update process. The application fails to implement proper cryptographic signature validation or secure hash verification for downloaded update packages. Without these safeguards, the update mechanism cannot distinguish between legitimate vendor updates and maliciously crafted payloads.

This type of vulnerability typically occurs when:

• Update packages are downloaded over insecure channels without TLS verification
• Cryptographic signatures on update packages are not validated
• Hash integrity checks are missing or improperly implemented
• The application trusts update content without verification

Attack Vector

An attacker with local access to the system can exploit this vulnerability by intercepting or manipulating the software update process. The attack scenario typically involves:

1. The attacker positions themselves to intercept update traffic (via ARP spoofing, DNS hijacking, or compromising the local network)
2. When SuperDuper! checks for or downloads updates, the attacker serves a malicious update package
3. Due to the lack of integrity verification, the application accepts and executes the malicious payload
4. The attacker gains code execution with the same privileges as the SuperDuper! application

Since SuperDuper! is a backup application that often requires elevated privileges to access system files, successful exploitation could grant the attacker significant control over the target system.

Detection Methods for CVE-2025-61228

Indicators of Compromise

• Unexpected network connections from SuperDuper! to unknown or suspicious endpoints
• Modification of SuperDuper! application files or associated binaries outside of legitimate update windows
• Anomalous process spawning from the SuperDuper! application
• Unsigned or improperly signed executables in the SuperDuper! application directory
• Unexpected privilege escalation attempts following SuperDuper! update activities

Detection Strategies

Organizations should implement monitoring for software update activities, particularly focusing on:

1. Network Traffic Analysis: Monitor outbound connections from SuperDuper! for connections to non-standard update servers or suspicious domains
2. File Integrity Monitoring: Track changes to SuperDuper! application files and directories for unauthorized modifications
3. Process Monitoring: Watch for unexpected child processes spawned by the SuperDuper! application
4. Code Signing Validation: Verify that all SuperDuper! binaries maintain valid Apple code signatures

SentinelOne Singularity XDR provides behavioral detection capabilities that can identify suspicious activity patterns associated with software update exploitation, including unauthorized code execution and privilege escalation attempts.

Monitoring Recommendations

• Enable application-level logging for SuperDuper! update activities
• Configure endpoint detection solutions to alert on unsigned binary execution from application directories
• Implement network segmentation to limit potential man-in-the-middle attack vectors
• Utilize SentinelOne's real-time threat detection to identify malicious payloads delivered through compromised update mechanisms
• Monitor for unusual file system activities in /Applications/SuperDuper!.app/ and related directories

How to Mitigate CVE-2025-61228

Immediate Actions Required

• Update Shirt Pocket SuperDuper! to version 3.11 or later immediately
• Disable automatic updates until the patched version is deployed
• Audit systems for any signs of compromise if vulnerable versions were in use
• Verify the integrity of existing SuperDuper! installations by checking code signatures
• Monitor affected systems for suspicious activity during the remediation period

Patch Information

Shirt Pocket has released SuperDuper! version 3.11 as a security update addressing this vulnerability. The patch implements proper integrity verification for the software update mechanism. Administrators should:

1. Download the update directly from the official Shirt Pocket website
2. Verify the download integrity using the vendor-provided checksums
3. Deploy the update to all affected systems
4. Confirm successful installation by verifying the application version

For detailed release notes, refer to the vendor's security advisory at: https://www.shirtpocket.com/blog/index.php/shadedgrey/comments/superduper_security_update_v311/

Workarounds

If immediate patching is not possible, the following workarounds can reduce exposure:

Organizations unable to immediately update should disable the automatic update feature within SuperDuper! until the patch can be applied. Manual updates should only be performed by downloading directly from the verified vendor website over a trusted network connection.

Additionally, implementing network-level controls to restrict SuperDuper!'s outbound connectivity to only known legitimate Shirt Pocket update servers can help mitigate man-in-the-middle attack scenarios. Endpoint protection solutions like SentinelOne should be configured to monitor and block suspicious execution patterns from backup application directories.

# Verify SuperDuper! version after patching
defaults read /Applications/SuperDuper\!.app/Contents/Info.plist CFBundleShortVersionString
# Expected output: 3.11 or higher

# Check code signature validity
codesign -vv /Applications/SuperDuper\!.app