New macOS zero-day bug lets attackers run commands remotely
A new vulnerability in Apple’s macOS Finder was revealed today, allowing attackers to run arbitrary instructions on Macs running any macOS version up to the most recent release, Big Sur.
Zero-day vulnerabilities are defects that have been publicly published but have not yet been patched by the vendor and are sometimes actively exploited by attackers or have publicly available proof-of-concept exploits.
The flaw, discovered by independent security researcher Park Minchan, is caused by the way macOS processes inetloc files, which permits it to mistakenly run any commands encoded inside by an attacker without any warnings or prompts.
Internet location files with on macOS.
inetloc extensions are system-wide bookmarks for opening internet resources (news:/, ftp:/, afp:/) or local files (file:/).
“A vulnerability in macOS Finder allows files whose extension is inetloc to execute arbitrary commands,” an SSD Secure Disclosure advisory published today revealed.
“These files can be embedded inside emails which if the user clicks on them will execute the commands embedded inside them without providing a prompt or warning to the user.”
Apple botches the patch and fails to assign a CVE ID.
As Minchan later revealed, Apple’s patch only partially addressed the weakness, as it can still be exploited by changing the protocol used to execute the embedded commands from file:/ to FiLe:/.
“Newer versions of macOS (from Big Sur) have blocked the file:// prefix (in the com.apple.generic-internet-location) however they did a case matching causing File:// or fIle:// to bypass the check,” the advisory adds.
“We have notified Apple that FiLe:// (just mangling the value) doesn’t appear to be blocked, but have not received any response from them since the report has been made. As far as we know, at the moment, the vulnerability has not been patched.”
Although the study did not specify how attackers may exploit this flaw, it might be exploited by threat actors to generate malicious email attachments that, when opened by the target, execute a packaged or remote payload.
BleepingComputer further examined the researcher’s proof-of-concept exploit and found that it could be used to perform arbitrary commands on macOS Big Sur without any prompts or warnings by utilising specially designed files received from the Internet.
An.inetloc file containing the PoC code was not recognised by any of the antimalware engines on VirusTotal, implying that macOS users who may be targeted by threat actors employing this attack vector will be unprotected.
