id: insecure-launchd-jobs

info:
  name: macOS World-Writable Launchd Jobs
  author: geeknik
  severity: medium
  description: |
    Searches for world-writable launchd job files on macOS that allow modification by any user.
  impact: |
    World-writable launchd job files can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
  remediation: |
    Review and correct the permissions of world-writable launchd job files.
  tags: macos,audit,local,security,launchd

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      find /System/Library/LaunchDaemons/ /System/Library/LaunchAgents/ /Library/LaunchDaemons/ /Library/LaunchAgents/ ~/Library/LaunchAgents/ -perm -o+w -type f -ls 2>/dev/null
    matchers:
      - type: regex
        regex:
          - "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
# digest: 4a0a00473045022100d79cf12bf41b029f55016ee394b8bbe07438a24579d556e97b47fb4cf336c2f102204ddd8161cde0e4501b0af970e45f01dd08aa1146117665257d4e8afd6d2ba8fc:922c64590222798bb761d5b6d8e72950