# [Fixed] KIS for macOS is vulnerable to AV bypass due to improper client authorization on XPC service

Kaspersky Internet Security macOS system extension XPC service only checked Team ID, letting a user inject a dylib into an old installer to disable AV scanning.

- Payout: hidden
- Severity: medium
- Program: Kaspersky
- Found by: theevilbit
- Disclosed: 2021-04-01
- CVE: CVE-2021-26718
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/980876
- Library page: https://bugbountylibrary.com/r/h1%3A980876
- Tags: area:os domain:desktop impact:integrity impact:privesc kind:bounty platform:hackerone sev:medium technique:reverse-engineering technique:source-review vuln:access-control vuln:auth-bypass vuln:dependency-confusion

**Target:** macOS endpoint security system extension XPC service (IPCService)
**Root cause:** shouldAcceptNewConnection: verified only the connecting process's Team ID (via PID) and not bundle ID, signature, or hardened-runtime entitlements, so any process signed by the same team ID—including an injectable old installer—could connect.
**Steps:**
1. Locate NEMachServiceName in the system extension Info.plist (`2Y8XE5CQ94.com.kaspersky.kav.sysext`)
2. Download old KIS installer whose Downloader.app has `com.apple.security.cs.disable-library-validation` entitlement
3. Replace `libkl_appkit.dylib` with a reexporting proxy dylib signed with a valid cert
4. Run installer from `/Users/Shared` so injected dylib loads
5. In constructor, connect via `initWithMachServiceName:options:4096` to IPCServiceProtocol
6. Call `getEndpointForProtocol:@"FileMonitorProtocol"` to obtain NSXPCListenerEndpoint
7. Open new NSXPCConnection to endpoint with FileMonitorProtocol and call `DisableReadonlyVolumeScan:1`
8. Observe log `FileMonitor: disabling read-only volume scan`
**How found:** Read the SEXT Info.plist for the Mach service name, then reverse-engineered IPCService's shouldAcceptNewConnection: and noticed it only compared Team ID; realized an injectable older Kaspersky binary shares that Team ID and could be used as a proxy client.
**Exploitation:** Attacker downloads an older KIS installer with library validation disabled, dylib-proxies libkl_appkit.dylib to run code inside a Kaspersky-signed process, then uses that trusted process to talk to the SEXT XPC service and invoke privileged methods like DisableReadonlyVolumeScan, disabling AV functionality as an unprivileged user.
**Escalation:** Once connected, any protocol endpoint (e.g. ConnectionInterceptorProtocol) can be requested, giving full control of the AV extension beyond just disabling volume scans.
**Insight:** When an XPC service validates clients by Team ID only, hunt for any same-team signed binary with disable-library-validation or get-task-allow entitlements—an old installer version is a reliable injection host to impersonate the trusted client.