Description

Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at a predictable path and installs it with administrator privileges, which may allow code execution with root privileges after user approval. A local process may also replace the staged macOS package while the skill waits for approval.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-06T17:17:11.353Z",
  "pubdate": "2026-11-06T17:17:11.353Z",
  "executiveSummary": "The Progress Software Fiddler Download and Setup Skill exhibits a critical vulnerability stemming from a lack of integrity verification during the acquisition and installation of release components.\nThis flaw affects Linux, macOS, and Windows platforms, allowing a local attacker to manipulate staged packages to facilitate arbitrary code execution.\nOn macOS, the vulnerability is particularly severe due to the use of a predictable staging path and the elevation of installation privileges to the root level.\nBy replacing the staged package while the installation process awaits user approval, an attacker can achieve unauthorized code execution with administrative or root privileges.\nThis vulnerability represents a significant security risk, as it permits an attacker to compromise the integrity of the software deployment process, potentially leading to persistent system compromise or privilege escalation.\nSuccessful exploitation requires local access to the system and the ability to intercept or replace the staged installer file during the installation workflow.",
  "technicalDetails": "The core vulnerability lies in the Fiddler Download and Setup Skill's failure to perform cryptographic signature validation or checksum verification on downloaded release components prior to execution.\nThis absence of integrity checks allows for unauthorized modification of the installation payload, enabling an attacker to inject arbitrary instructions into the setup process.\nOn macOS systems, the installation routine utilizes a predictable, hardcoded path for staging the installer package. This predictability creates a race condition window that is exploitable by local processes.\nThe attack flow follows a structured sequence: First, the user triggers the Fiddler Download and Setup Skill. The skill initiates the download of a release component and saves it to the insecure, predictable staging location.\nBecause the system waits for user authorization before executing the installer, an attacker with local access can monitor the filesystem for the creation of the staged package. Upon detection, the attacker replaces the legitimate installer with a malicious payload while maintaining the original filename to avoid triggering system alerts.\nWhen the user subsequently grants approval for the installation, the setup routine executes the attacker-controlled package. On macOS, this process typically runs with elevated administrative privileges, resulting in the malicious code executing with root-level access.\nThe privilege escalation path is facilitated by the assumption that the downloaded content is trusted; the installer does not re-verify the authenticity of the staging directory's contents post-download.\nThe impact is a full compromise of the user's local environment, as the attacker gains the ability to execute arbitrary code within the security context of the installer process. This allows for the installation of backdoors, exfiltration of local credentials, or the modification of sensitive system files, all while potentially bypassing standard macOS security controls by piggybacking on a legitimately initiated installation request.\nSince the vulnerability exists within the download and setup logic, no specific network-level authentication is required, though the attacker must be positioned locally or have compromised a local user account to interact with the staging filesystem."
}