A new vulnerability in macOS’ Finder file manager reportedly makes it possible for attackers to run arbitrary commands on Macs across all versions of the operating system including the latest release, Big Sur.
BleepingComputer reports that the bug, reported by cybersecurity researcher Park Minchan, exists because of how macOS handles internet location (inetloc) shortcuts.
“A vulnerability in macOS Finder allows files whose extension is inetloc to execute arbitrary commands, these files can be embedded inside emails which if the user clicks on them will execute the commands embedded inside them without providing a prompt or warning to the user," reads an advisory on the issue from SSD Secure Disclosure.
- Protect your devices with these best antivirus software
- Take a look at these best antivirus software for macOS
- These are the best malware removal software on the market
Although Minchan hasn’t provided details on how attackers might abuse the vulnerability, BleepingComputer suggests one way to exploit it is by delivering malicious email attachments that could perhaps launch a bundled or remote payload.
Addressed improperly
The SSD Secure Disclosure advisory suggests that Apple has silently fixed the issue without assigning a CVE identification number. However, a followup by Minchan reveals that Apple's patch addresses the flaw only partially, and it can still be exploited with slight variations to the attack methodology.
“We have notified Apple that FiLe:// (just mangling the value) doesn’t appear to be blocked, but have not received any response from them since the report has been made. As far as we know, at the moment, the vulnerability has not been patched,” claims the SSD Secure Disclosure advisory.
BleepingComputer went one step ahead and tested a proof-of-concept exploit shared by Minchan, which worked just as the researcher had observed in his disclosure.
- We’ve also compiled a list of the best ransomware protection tools
Via BleepingComputer
