Apple fixes macOS zero-day exploited by malware (CVE-2021-30713)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-30713 | Privacy Preferences (TCC) Bypass in Apple macOS, Actively Exploited CVE-2021-30713 is a permissions/authorization flaw (CWE-862) in Apple macOS that allows a malicious application already running on a machine to bypass the user's Privacy preferences, which govern which apps may access protected user data such as files, camera, microphone, and other consent-protected resources. The flaw is triggered locally: a malicious app that a user has launched can silently circumvent the Privacy controls without the usual approval prompt. Successful exploitation grants the attacker access to user data that should have required explicit user consent, with high impact to confidentiality, integrity, and availability per its 7.8 CVSS score. Any Mac running a version of macOS prior to the macOS Big Sur 11.4 fix is affected. Apple acknowledged a report that the issue was being actively exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03; the EPSS score of 7.0% (94th percentile) further indicates meaningful near-term exploitation risk. Do: Upgrade affected Macs to macOS Big Sur 11.4 or later immediately, as this issue is listed in CISA's KEV catalog with active exploitation confirmed. Audit Macs for unknown or recently installed applications that accessed protected data (files, camera, microphone) without a consent prompt, and prioritize internet-facing and high-value endpoints. Since Apple shipped this fix alongside other actively exploited zero-days in the same release cycle, ensure devices are fully updated rather than partially patched. | 7.8 | 7% | KEV |
| masstens of millions of Macs (macOS runs on an installed base estimated at 100M+ devices, and Big Sur was the current release when the patch shipped) |
Full article402 words · extracted from helpnetsecurity.com · click to collapse
A zero-day vulnerability (CVE-2021-30713) that allowed XCSSET malware to surreptitiously take screenshots of the victim’s desktop has been fixed by Apple on macOS 11.4 (Big Sur) on Monday.
The XCSSET malware and its CVE-2021-30713 exploitation
Discovered in August 2021 by Trend Micro researchers, XCSSET is effectively trojan spyware that can grab user data from Safari and other installed browsers, read Safari cookies, inject JavaScript backdoors onto websites, grab information from a variety of apps (Evernote, Telegram, WeChat, etc.), capture screenshots of the user’s screen, and more.
The malware is written in AppleScript – a scripting language developed by Apple – that facilitates control over script-enabled Mac applications.
It was previously discovered that XCSSET used a zero-day exploit to steal Safari browser cookies and another one to seamlessly install a developer version of the Safari application (which is used to inject JavaScript backdoors onto websites). Jamf researchers now found that it exploits a third zero-day to bypass Apple’s Transparency Consent and Control (TCC) protections.
“[The TCC framework] is the system that controls what resources applications have access to,” the researchers explained. “From the user’s perspective, TCC is the prompt they receive when a program attempts to perform an action that Apple believes should require explicit permission from the user before allowing the action to occur.”
Users see that prompt when, for example, an app wants to access the computer’s microphone or camera, record the screen, save files to the Documents directory, etc.
XCSSET bypasses the TCC protections by using an AppleScript module to search for an application that has permissions to capture a screenshot and compiling it into a custom AppleScript application (“avatarde.app”) that is injected into that “donor” application.
By doing this, the malware effectively gains the permission to make screenshots without having to ask the user for it. Even worse – the vulnerability can be used to gain multiple other permissions that have already been provided to the donor application.
Update your Mac (and other iDevices)
CVE-2021-30713 has been patched in macOS Big Sur 11.4, which was released on Monday. The updated OS also brings many other security fixes.
At the same time, Apple has also released security updates for macOS Catalina and Mojave, Safari 14.1.1, iOS 14.6 and iPadOS 14.6, tvOS 14.6 and watchOS 7.5. Details about the security content of these updates can be found here.
Users are advised to implement the updates as soon as possible.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/05/25/cve-2021-30713-exploited/