The DNS Field That Could Run Anything as Root
Sonar has a Control tab. One of the things it does is switch the DNS resolver for your Mac — tap Cloudflare, tap Quad9, or paste in the address of your own Pi-hole. Changing a network service's DNS servers is a privileged operation, so the app asks macOS for authorisation and runs networksetup on the other side of that prompt. That is a completely ordinary feature. It is also where I put a…
The DNS field within the Sonar app allows users to specify their preferred DNS server. This field is a privileged operation that requires macOS authorization. The field takes a string input, which is then passed to a privileged command. This security oversight led to a command-injection vulnerability, allowing an attacker to execute code with root privileges.
The issue arose because the developer assumed the input was merely an IP address, when in fact it could contain any string. To address the vulnerability, the developer should validate the input to ensure it only contains valid DNS server addresses, parse it into an IPv4 or IPv6 format, and pass it as an array to a process, avoiding shell interpretation altogether.
Additionally, sensitive information such as API tokens should be stored securely in the Keychain rather than in plain files. These changes will help prevent command-injection attacks and protect the system from unauthorized access.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
