Executive brief
SuperDuper! is a backup and disk cloning utility for macOS. A security flaw in versions 3.10 and earlier allows a local attacker or malicious software already on the system to modify backup task templates. This could allow the attacker to run unauthorized scripts with administrative (root) privileges and Full Disk Access, effectively bypassing macOS privacy protections and gaining total control over the computer's data.
Technical details
This vulnerability is classified as improper access control (CWE-284) or incorrect default permissions (CWE-276) within the handling of 'Before/After' shell scripts in SuperDuper!. In affected versions, these user-settable scripts are executed with escalated privileges (root) and inherit the application's TCC Full Disk Access permissions. A local attacker or malicious process can modify the settings files associated with a copy task or schedule to point to a malicious script. Because the application does not sufficiently validate the ownership or integrity of these scripts before execution, the attacker's code runs with elevated permissions, bypassing macOS privacy controls. The issue is addressed in version 3.11 by forcing scripts to run with the user's ID and requiring scripts to be owned by the root user.
Affected products
- Shirt Pocket SuperDuper! 3.10 and earlier
Timeline
- 2025-11-18: patched: Vendor released version 3.11 to address the issue.
- 2025-12-01: disclosed: CVE published to NVD.