CVE-2025-61229 Overview
CVE-2025-61229 affects Shirt Pocket's SuperDuper! backup utility for macOS, versions 3.10 and earlier. A local attacker can modify the default task template to execute an arbitrary preflight script with root privileges and Full Disk Access. The flaw bypasses macOS privacy controls (Transparency, Consent, and Control / TCC), granting attackers unrestricted access to protected user data and system resources. The issue is tracked under [CWE-276] Incorrect Default Permissions and [CWE-284] Improper Access Control.
Critical Impact
Local attackers gain root execution and Full Disk Access, bypassing macOS TCC privacy controls to read protected user data and modify system state.
Affected Products
- Shirt Pocket SuperDuper! 3.10 and earlier
- macOS systems running vulnerable SuperDuper! installations
- Backup task templates stored in user-writable locations
Discovery Timeline
- 2025-12-01 - CVE-2025-61229 published to NVD
- 2025-12-08 - Last updated in NVD database
Technical Details for CVE-2025-61229
Vulnerability Analysis
SuperDuper! is a macOS backup and cloning utility that requires Full Disk Access to read protected directories during backup operations. To support automated and scheduled backups, the application uses task templates that define backup behavior, including optional preflight and postflight scripts that run before or after a backup job.
The vulnerability stems from the default task template being writable by a local low-privilege user. An attacker who can modify this template can insert an arbitrary preflight script. When the privileged helper component subsequently processes the template, the attacker-supplied script runs as root with the application's Full Disk Access entitlement.
The outcome is a bypass of the macOS Transparency, Consent, and Control (TCC) framework. Files normally protected by TCC, including mail, messages, browser history, and other user data, become readable. The attacker also gains arbitrary code execution as root.
Root Cause
The root cause is improper access control on the default task template file ([CWE-276], [CWE-284]). The template is treated as trusted input by the privileged helper, yet its on-disk location and permissions allow modification by an unprivileged local user. No integrity validation is performed before the helper executes the referenced preflight script.
Attack Vector
Exploitation requires local access with low privileges. The attacker writes a malicious shell script and updates the default SuperDuper! task template to reference it as a preflight script. When SuperDuper! executes the backup job through its privileged helper, the script runs as root and inherits the application's TCC permissions. The attacker does not need user interaction beyond triggering or waiting for a scheduled task.
No verified public exploit code is available for this vulnerability. See the Shirt Pocket Blog Update for vendor remediation details.
Detection Methods for CVE-2025-61229
Indicators of Compromise
- Unexpected modifications to SuperDuper! task template files in user or shared application support directories
- New or altered preflight or postflight script paths referenced inside SuperDuper! .sdsp task documents
- Root-owned processes spawned by the SuperDuper! privileged helper that execute shell scripts from user-writable paths
- Access to TCC-protected directories (~/Library/Mail, ~/Library/Messages, ~/Library/Safari) by processes launched from SuperDuper! helpers
Detection Strategies
- Monitor file integrity on the SuperDuper! default task template and any user task files, alerting on unauthorized writes
- Hunt for child processes of the SuperDuper! privileged helper that execute interpreters such as bash, zsh, osascript, or python with non-standard arguments
- Correlate elevated process execution with subsequent reads of TCC-protected user data paths
Monitoring Recommendations
- Enable macOS Endpoint Security event logging for ES_EVENT_TYPE_NOTIFY_EXEC and ES_EVENT_TYPE_NOTIFY_WRITE on SuperDuper! template locations
- Track installations and versions of SuperDuper! across managed Macs to identify unpatched 3.10 and earlier endpoints
- Alert on any process running as root that originates from a backup application but accesses sensitive user data outside backup destinations
How to Mitigate CVE-2025-61229
Immediate Actions Required
- Upgrade SuperDuper! to version 3.11 or later on all macOS endpoints
- Audit existing task templates for unauthorized preflight or postflight script references and remove untrusted entries
- Restrict local user accounts on shared macOS systems to limit who can modify SuperDuper! task files
- Review macOS Full Disk Access grants and remove the entitlement from SuperDuper! until patched
Patch Information
Shirt Pocket released SuperDuper! 3.11 to address the vulnerability. Details and download links are available in the Shirt Pocket Blog Update. Administrators managing fleets should deploy the update through their preferred macOS management platform and verify the installed version after deployment.
Workarounds
- Remove Full Disk Access from SuperDuper! in System Settings until the update is applied, accepting reduced backup functionality
- Disable scheduled backup tasks that rely on the default task template
- Apply stricter filesystem permissions on the SuperDuper! task template directory to block writes by non-administrative users
# Verify SuperDuper! version on a macOS endpoint
defaults read "/Applications/SuperDuper!.app/Contents/Info.plist" CFBundleShortVersionString
# Revoke Full Disk Access entitlement (requires admin) until patched
tccutil reset SystemPolicyAllFiles com.blacey.SuperDuper
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
