Popular Microsoft apps for Mac at risk of code injection attacks

[Pelican Press 0]

This is the hidden content, please

• Sign In
• or
• Sign Up

Popular

This is the hidden content, please

• Sign In
• or
• Sign Up

apps for Mac at risk of code injection attacks

Several

This is the hidden content, please

• Sign In
• or
• Sign Up

applications designed specifically for the Apple macOS operating system are at risk of being subverted by malicious actors, according to

This is the hidden content, please

• Sign In
• or
• Sign Up

.

Talos researcher Francesco Benvenuto found eight vulnerabilities in widely used

This is the hidden content, please

• Sign In
• or
• Sign Up

properties including Excel, OneNote,

This is the hidden content, please

• Sign In
• or
• Sign Up

, PowerPoint, Teams and Word.

If exploited, the flaws would enable a threat actor to take advantage of Apple’s permission settings to inject malicious libraries into the vulnerable apps and gain control of their entitlements and user permissions.

“Permissions regulate whether an app can access resources such as the microphone, camera, folders, screen recording, user input and more. So, if an adversary were to gain access to these, they could potentially ***** sensitive information or, in the worst case, escalate privileges,” wrote Benvenuto.

How it works

The scope of the problem hinges on how macOS handles third-party app permissions. Usually, operating systems base these policies on the principles of

This is the hidden content, please

• Sign In
• or
• Sign Up

(DAC), but this provides very limited protection against vulnerable software or malware running with user or root privileges.

Apple therefore goes further, securing access to some resources using

This is the hidden content, please

• Sign In
• or
• Sign Up

(TCC), which requires apps to obtain explicit human consent before accessing protected things such as the microphone, camera and so on.

This consent mechanism manifests to the user as a pop-up, which will be familiar to most Mac owners. That decision is then recorded for future reference, and can be changed via the device Privacy & Security settings in future if wanted.

Now, macOS also includes provisions to stop code injection by requiring apps distributed through the App Store to submit to sandboxing, which restricts access to resources that the app explicitly requests through entitlements – some of which are further governed by the user consent pop-up.

As an example, Benvenuto explained, a properly sandboxed app will prompt for camera access only if it has the camera entitlement set to ‘true’. If that entitlement isn’t present, it won’t be allowed, and the user won’t ever see a pop-up.

Notarised apps – those that have been checked by Apple’s scanners for dodgy components – are also required to enable hardened runtime to make them more resistant to code injection.

These apps, which include all the

This is the hidden content, please

• Sign In
• or
• Sign Up

ones in scope of the research, that may need to perform higher risk actions such as loading an untrusted library, must declare that intent through their entitlements. In this case, its developers need to set the disable library validation entitlement to ‘true’.

All together, these features are supposed to work together to provide enhanced protection for Mac users, However, if an attacker is able to inject a malicious code library into the process space of a running application, said library can then use all the permissions that have been granted to it.

So, as demonstrated by the research, the

This is the hidden content, please

• Sign In
• or
• Sign Up

apps in scope become vulnerable if they load a library that a threat actor compromised.

Responsible handling

Benvenuto said that to be truly effective – and secure – Apple’s model depends on applications responsibly handling their permissions.

“MacOS trusts applications to self-police their permissions. A ******** in this responsibility leads to a breach of the entire permission model, with applications inadvertently acting as proxies for unauthorised actions, circumventing TCC and compromising the system’s security model. This highlights the importance for applications to implement robust security measures to avoid becoming vectors for exploitation.”

Benvenuto went on to state that the

This is the hidden content, please

• Sign In
• or
• Sign Up

apps appear to be using the library validation entitlement to support plug-ins, which should mean plug-ins signed by third-party developers but in this instance, really seems to refer only to

This is the hidden content, please

• Sign In
• or
• Sign Up

’s own Office add-ins. He said this raised further questions about why

This is the hidden content, please

• Sign In
• or
• Sign Up

needed to disable library validation at all if no external libraries are expected to turn up.

“By using this entitlement,

This is the hidden content, please

• Sign In
• or
• Sign Up

is circumventing the safeguards offered by the hardened runtime, potentially exposing its users to unnecessary risks,” he wrote.

Eight vulnerabilities

The issues described by the Cisco Talos team have been assigned the following designations:

• CVE-2024-39804 in
  This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  PowerPoint;
• CVE-2024-41138 in
  This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  Teams (work or school) com.
  This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  .teams2.modulehost.app;
• CVE-2024-41145 in
  This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  Teams (work or school) WebView.app helper app;
• CVE-2024-41159 in
  This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  OneNote;
• CVE-2024-41165 in
  This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  Word;
• CVE-2024-42004 in
  This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  Teams (work or school);
• CVE-2024-42220 in
  This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  ;
• And CVE-2024-43106 in
  This is the hidden content, please

  • Sign In
  • or
  • Sign Up
  Excel.

According to Benvenuto,

This is the hidden content, please

• Sign In
• or
• Sign Up

has said it considers these issue to be low risk, and it has supposedly declined to fix some of them because the apps need to allow loading of unsigned libraries to support the Office add-ins.

At the time of writing, both Teams and OneNote have had the problematic entitlement removed and are no longer vulnerable to exploitation. The others remain at risk.

This is the hidden content, please

• Sign In
• or
• Sign Up

#Popular #

This is the hidden content, please

• Sign In
• or
• Sign Up

#apps #Mac #risk #code #injection #attacks

This is the hidden content, please

• Sign In
• or
• Sign Up

This is the hidden content, please

• Sign In
• or
• Sign Up

For verified travel tips and real support, visit: https://hopzone.eu/