A new vulnerability in macOS (opens in new tab)’ Finder file manager reportedly makes it possible for attackers to run arbitrary commands on Macs (opens in new tab) across all versions of the operating system including the latest release, Big Sur (opens in new tab).
BleepingComputer reports that the bug, reported by cybersecurity (opens in new tab) researcher Park Minchan, exists because of how macOS handles internet location (inetloc) shortcuts.
“A vulnerability in macOS Finder allows files whose extension is inetloc to execute arbitrary commands, these files can be embedded inside emails which if the user clicks on them will execute the commands embedded inside them without providing a prompt or warning to the user," reads an advisory on the issue from SSD Secure Disclosure.
- Protect your devices with these best antivirus software (opens in new tab)
- Take a look at these best antivirus software for macOS (opens in new tab)
- These are the best malware removal (opens in new tab) software on the market
Although Minchan hasn’t provided details on how attackers might abuse the vulnerability, BleepingComputer suggests one way to exploit it is by delivering malicious email attachments that could perhaps launch a bundled or remote payload.
Addressed improperly
The SSD Secure Disclosure advisory suggests that Apple has silently fixed the issue without assigning a CVE identification number. However, a followup by Minchan reveals that Apple's patch addresses the flaw only partially, and it can still be exploited with slight variations to the attack methodology.
“We have notified Apple that FiLe:// (just mangling the value) doesn’t appear to be blocked, but have not received any response from them since the report has been made. As far as we know, at the moment, the vulnerability has not been patched,” claims the SSD Secure Disclosure advisory.
BleepingComputer went one step ahead and tested a proof-of-concept exploit shared by Minchan, which worked just as the researcher had observed in his disclosure.
- We’ve also compiled a list of the best ransomware protection tools (opens in new tab)
Via BleepingComputer (opens in new tab)
