CVE-2025-69604: SuperDuper! Privilege Escalation Flaw

CVE-2025-69604 Overview

CVE-2025-69604 is a local privilege escalation vulnerability in Shirt Pocket's SuperDuper! backup application for macOS. The vulnerability allows a local attacker to modify the default task template to install an arbitrary package capable of executing shell scripts with root privileges and Full Disk Access, effectively bypassing macOS privacy controls.

Critical Impact

Local attackers can leverage this vulnerability to gain root privileges and Full Disk Access on macOS systems, completely bypassing the operating system's built-in privacy protections and security controls.

Affected Products

• Shirt Pocket SuperDuper! version 3.11
• Shirt Pocket SuperDuper! versions earlier than 3.11

Discovery Timeline

• 2026-01-29 - CVE CVE-2025-69604 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2025-69604

Vulnerability Analysis

This vulnerability represents a local privilege escalation attack path in the SuperDuper! backup application for macOS. The core issue lies in the application's handling of task templates, which can be manipulated by a local attacker to inject malicious packages.

SuperDuper! is a popular macOS backup utility that requires elevated privileges to perform complete system backups. The application utilizes task templates that define backup operations, and these templates have the capability to execute packages with root-level permissions. The vulnerability exists because the default task template can be modified by a local user without proper authorization checks, creating an avenue for privilege escalation.

When exploited, an attacker can craft a malicious package that gets executed within the privileged context of SuperDuper!'s backup operations. Since the application possesses Full Disk Access to perform comprehensive backups, any code executed through the modified task template inherits these elevated permissions, allowing complete bypass of macOS privacy controls including TCC (Transparency, Consent, and Control) protections.

Root Cause

The root cause of this vulnerability is improper access control on the task template configuration mechanism in SuperDuper!. The application fails to adequately validate or protect the integrity of task templates, allowing local users to modify them. When combined with the application's requirement for root privileges and Full Disk Access, this creates a privilege escalation pathway where arbitrary code can be executed with system-level permissions.

Attack Vector

The attack requires local access to the target macOS system. An attacker with standard user privileges can modify the SuperDuper! default task template to include a reference to a malicious installer package. This package can contain shell scripts or other executables that will run with root privileges when SuperDuper! processes the modified template during its normal backup operations.

The attack flow involves locating the task template storage location, crafting a malicious package with desired payloads, modifying the template to reference this package, and waiting for or triggering a backup operation. Once the backup task executes, the malicious package runs with the full privileges of the SuperDuper! application, granting the attacker root access and the ability to bypass macOS privacy controls.

Detection Methods for CVE-2025-69604

Indicators of Compromise

• Unauthorized modifications to SuperDuper! task template files or configuration directories
• Unexpected package installations occurring during SuperDuper! backup operations
• New or unknown shell scripts executing with root privileges originating from SuperDuper! processes
• TCC database modifications or privacy bypass events correlated with SuperDuper! activity

Detection Strategies

• Monitor file system changes to SuperDuper! configuration and template directories for unauthorized modifications
• Implement process monitoring to detect unexpected child processes spawned by SuperDuper! with elevated privileges
• Use endpoint detection rules to alert on package installations initiated by backup applications
• Deploy integrity monitoring on critical macOS privacy control databases and configurations

Monitoring Recommendations

• Enable audit logging for file modifications in the SuperDuper! application support directories
• Configure alerts for any new processes gaining Full Disk Access or TCC entitlements unexpectedly
• Monitor for shell script execution patterns associated with macOS backup application contexts
• Implement baseline behavior analysis for SuperDuper! operations to detect anomalous activity

How to Mitigate CVE-2025-69604

Immediate Actions Required

• Review and restrict file system permissions on SuperDuper! configuration and template directories
• Audit existing task templates for any unauthorized modifications or suspicious package references
• Consider temporarily suspending automated SuperDuper! backup operations until patched
• Implement additional access controls to limit which users can modify backup configurations

Patch Information

Users should check the Shirt Pocket blog for the latest version information and security updates. The SuperDuper! product page provides download links for current releases. Organizations should upgrade to versions newer than 3.11 once security patches addressing this vulnerability become available.

Workarounds

• Restrict write access to SuperDuper! task template directories to administrator accounts only
• Implement file integrity monitoring on SuperDuper! configuration files to detect unauthorized changes
• Use macOS endpoint protection to block unauthorized package installations from backup application contexts
• Consider using alternative backup solutions until this vulnerability is addressed by the vendor

# Restrict permissions on SuperDuper! configuration directories
# Adjust paths based on your installation
sudo chmod -R 755 /Library/Application\ Support/SuperDuper\!/
sudo chown -R root:admin /Library/Application\ Support/SuperDuper\!/

# Enable file system auditing for configuration changes
sudo auditctl -w /Library/Application\ Support/SuperDuper\!/ -p wa -k superduper_config