Zero-Click Calendar invite – Critical zero-click vulnerability chain in macOS
A zero-click vulnerability in macOS, identified as CVE-2022–46723, allows attackers to manipulate Calendar files and access iCloud Photos. Apple has released updates to address these issues from 2022 to 2023.
Read original article
A critical zero-click vulnerability chain in macOS was discovered by Mikko Kenttälä, allowing attackers to manipulate files within the Calendar sandbox environment. This vulnerability, identified as CVE-2022–46723, enables malicious calendar invites to be sent, which can lead to arbitrary file writes and deletions. The exploit can be leveraged to execute remote code, particularly during macOS upgrades, by injecting files that trigger malicious actions without user interaction. The final phase of the exploit allows access to sensitive iCloud Photos data by altering the configuration of the Photos application, bypassing security measures. Apple has addressed these vulnerabilities through various updates from October 2022 to September 2023, including fixes for the Calendar and Photos vulnerabilities. The timeline of the discovery and subsequent fixes highlights the ongoing efforts to secure macOS against such exploits.
- A zero-click vulnerability in macOS allows attackers to manipulate Calendar files.
- The exploit can lead to remote code execution and unauthorized access to iCloud Photos.
- Apple has released multiple updates to fix these vulnerabilities between 2022 and 2023.
- The vulnerability was reported as CVE-2022–46723 and involved a series of complex exploit phases.
- Ongoing security measures are necessary to protect users from such vulnerabilities.
Related
'Almost every Apple device' vulnerable to CocoaPods
Security researchers found vulnerabilities in CocoaPods, allowing malicious code insertion and remote code execution. Pod owners were at risk of a zero-click takeover. CocoaPods issued patches, emphasizing the need for secure software development practices.
CVE-2024-40798 – an app may be able to read Safari's browsing history
CVE-2024-40798 is a newly identified vulnerability in Safari that may expose browsing history. It has been fixed in several Apple software updates and awaits analysis without a CVSS severity score.
Study finds organizations have a significant gap in security on macOS endpoints
A study by Picus Security reveals macOS endpoints prevent only 23% of cyberattacks, with rising malware threats and weak security practices, emphasizing the need for enhanced security measures in organizations.
Unveiling Mac Security: Comprehensive Exploration of Sandboxing and AppData TCC
The blog analyzes macOS security, focusing on sandboxing, TCC, and SIP. It highlights over 40 vulnerabilities since mid-2023, discusses specific issues like CVE-2023-42947, and calls for improved disclosure and patching.
Microsoft Says Windows Update Zero-Day Being Exploited to Undo Security Fixes
Microsoft warns of a critical vulnerability, CVE-2024-43491, in Windows 10, version 1507, exploited to reverse security fixes. Users should install specific updates. Adobe also issued patches for critical flaws.
- Many commenters express frustration over Apple's handling of bounty payouts for reported vulnerabilities, questioning the company's commitment to rewarding legitimate security research.
- There is confusion and concern regarding the exploit's mechanics, particularly how it allows unauthorized access to user files and the inconsistent protection of relocated photo libraries.
- Some users reflect on the nature of the exploit, noting its old-fashioned approach and the implications of directory traversal attacks.
- Several comments highlight the importance of timely updates and patches from Apple, emphasizing user privacy and security.
- There is a call for more accountability from Apple, with suggestions that the company should be more transparent and responsive to security researchers.
18 commentsI just did a quick test on my Sonoma 14.6.1 system. Hold the Option key while opening Photos to create a new photo library in ~/Pictures; then use an app without full disk access permission and without photo permission to access that folder. That app was denied access. Then do the same except the new photo library is created in /tmp. That same app is allowed access. This behavior is baffling and inconsistent.
If Apple really intends to support the feature of allowing the user to relocate their photo library to anywhere on the file system, they need to apply the protection properly.
Seems just way too many different systems have the ability to modify those flags.
What's the scope of this? Can anyone on macOS anywhere really just send random invites to anyone else who uses icloud? Who would even want that?
That's bad engineering.
> The attacker can exploit this to conduct a successful directory traversal attack by setting an arbitrary path to a file in the ATTACH section with: “FILENAME=../../../PoC.txt”.
Any guess on the bounty amount for this zero-click vulnerability, with a 5 step exploit chain for macOS?
NSO Group would have paid more, quicker
I know Apple has now switched to 10 years for MacOS, and 7ish years of iOS, but I hope the EU passes some laws to make this a requirement, rather than something a company can choose to provide or not.
Related
'Almost every Apple device' vulnerable to CocoaPods
Security researchers found vulnerabilities in CocoaPods, allowing malicious code insertion and remote code execution. Pod owners were at risk of a zero-click takeover. CocoaPods issued patches, emphasizing the need for secure software development practices.
CVE-2024-40798 – an app may be able to read Safari's browsing history
CVE-2024-40798 is a newly identified vulnerability in Safari that may expose browsing history. It has been fixed in several Apple software updates and awaits analysis without a CVSS severity score.
Study finds organizations have a significant gap in security on macOS endpoints
A study by Picus Security reveals macOS endpoints prevent only 23% of cyberattacks, with rising malware threats and weak security practices, emphasizing the need for enhanced security measures in organizations.
Unveiling Mac Security: Comprehensive Exploration of Sandboxing and AppData TCC
The blog analyzes macOS security, focusing on sandboxing, TCC, and SIP. It highlights over 40 vulnerabilities since mid-2023, discusses specific issues like CVE-2023-42947, and calls for improved disclosure and patching.
Microsoft Says Windows Update Zero-Day Being Exploited to Undo Security Fixes
Microsoft warns of a critical vulnerability, CVE-2024-43491, in Windows 10, version 1507, exploited to reverse security fixes. Users should install specific updates. Adobe also issued patches for critical flaws.