Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Share Post: Reddit Facebook
New macOS zero-day bug lets attackers run commands remotely
#1
https://www.bleepingcomputer.com/news/ap...-remotely/        New macOS zero-day bug lets attackers run commands remotely
By Sergiu Gatlan

    September 21, 2021 04:01 PM          Security researchers disclosed today a new vulnerability in Apple's macOS Finder, which makes it possible for attackers to run arbitrary commands on Macs running any macOS version up to the latest release, Big Sur.

Zero-days are publicly disclosed flaws that haven't been patched by the vendor which, in some cases, are also actively exploited by attackers or have publicly available proof-of-concept exploits.

The bug, found by independent security researcher Park Minchan, is due to the way macOS processes inetloc files which inadvertently causes it to run any commands embedded by an attacker inside without any warnings or prompts.

On macOS, Internet location files with .inetloc extensions are system-wide bookmarks that can be used to open online resources (news://, ftp://, afp://) or local files (file://).

"A vulnerability in macOS Finder allows files whose extension is inetloc to execute arbitrary commands,"  SSD Secure Disclosure advisory published today revealed.

"These files can be embedded inside emails which if the user clicks on them will execute the commands embedded inside them without providing a prompt or warning to the user."
macOS zero-day demo
Image: SSD Secure Disclosure
Apple botches patch, doesn't assign a CVE ID

While Apple silently fixed the issue without assigning a CVE identification number, as Minchan later discovered, Apple's patch only partially addressed the flaw as it can still be exploited by changing the protocol used to execute the embedded commands from file:// to FiLe://.

"Newer versions of macOS (from Big Sur) have blocked the file:// prefix (in the com.apple.generic-internet-location) however they did a case matching causing File:// or fIle:// to bypass the check," the advisory adds.

"We have notified Apple that FiLe:// (just mangling the value) doesn’t appear to be blocked, but have not received any response from them since the report has been made. As far as we know, at the moment, the vulnerability has not been patched."

Although the researcher did not provide any info on how this bug might be abused by attackers, it could potentially be used by threat actors to create malicious email attachments that, when opened by the target, would be able to launch a bundled or remote payload.

BleepingComputer also tested the proof-of-concept exploit shared by the researcher and was able to confirm that the vulnerability can be used to run arbitrary commands on macOS Big Sur using specially crafted files downloaded from the Internet without any prompts or warnings.

An .inetloc file with the PoC code was not detected by any of the antimalware engines on VirusTotal which means that macOS users potentially targeted by threat actors using this attack method won't be protected by security software.

An Apple spokesperson was not available for comment when contacted by BleepingComputer earlier today.
Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
  Hackers Breach University of Manchester; School Says Attackers Likely Copied Data mrtrout 0 532 06-12-2023 , 10:39 PM
Last Post: mrtrout
  SolarWinds Attackers Accessed DHS Secretary’s Emails — Report Bjyda 0 825 03-31-2021 , 09:38 PM
Last Post: Bjyda
  ‘Educational’ ransomware program may instead become a how-to guide for attackers Bjyda 0 1,013 03-08-2021 , 11:09 PM
Last Post: Bjyda
  Attackers scan for vulnerable VMware servers after PoC exploit release Bjyda 0 904 02-25-2021 , 11:54 PM
Last Post: Bjyda
  SDK Bug Lets Attackers Spy on User’s Video Calls Across Dating, Healthcare Apps Bjyda 0 829 02-19-2021 , 10:56 PM
Last Post: Bjyda

Forum Jump:


Users browsing this thread: 1 Guest(s)