Loading vulnerability…
CVE-2019-8513 is a local privilege escalation vulnerability in the macOS Time Machine diagnostic workflow affecting macOS 10.12.x through 10.14.3 and fixed in macOS Mojave 10.14.4. The flaw is a command injection issue in the privileged Time Machine diagnose path exposed through the timemachinehelper XPC service and the tmdiagnose diagnostic binary. The vulnerable logic executes shell commands through /bin/bash and constructs part of a command from disk enumeration output derived from mounted volume metadata. Because mounted volume names are attacker-controllable and were not safely validated or escaped before being incorporated into a shell command, a local user could craft a mounted disk image label containing shell metacharacters and parsing tricks to inject arbitrary commands. When the privileged diagnostic routine is triggered, the injected payload is executed with root privileges. Apple addressed the issue with improved checks.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module (modules/exploits/osx/local/timemachine_cmd_injection.rb) that exploits a local privilege escalation vulnerability (CVE-2019-8513) in macOS TimeMachine's tmdiagnose binary (versions <= 10.14.3). The exploit leverages a command injection flaw in the way tmdiagnose processes disk labels, allowing an attacker with local access to execute arbitrary code as root. The module supports multiple payload types (native x64, Python, command) and defaults to a reverse Meterpreter shell. The exploit requires the attacker to have a session on the target and write access to a directory (default: /tmp). The structure is typical for a Metasploit local exploit, with advanced options for configuration and built-in checks for target vulnerability. No network endpoints are involved; the attack vector is strictly local. The main fingerprintable endpoints are the /tmp directory (or another writable directory) and the tmdiagnose binary.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A command injection vulnerability referenced as a follow-on primitive that can be triggered via fbahelperd's diagnostic wrapper to help achieve privilege escalation.
A local privilege escalation vulnerability in macOS TimeMachine's diagnostic extension (tmdiagnose), allowing a local attacker to execute arbitrary commands as root via command injection in disk image volume labels. The flaw is 100% reliable and easy to exploit on affected versions.
A Time Machine/tmdiagnose command-injection vulnerability in macOS that allows a local user to execute arbitrary shell commands as root via a crafted mounted disk image label and XPC-triggered diagnostic workflow.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.