Expert published PoC exploit code for macOS sandbox escape flaw

guest · Nov 23, 2022

By Pierluigi Paganini - November 21, 2022

Researcher Wojciech Reguła (@_r3ggi) of SecuRing published technical details and proof-of-concept (PoC) code for a macOS sandbox escape vulnerability tracked as CVE-2022-26696 (CVSS score of 7.8).
Click to expand...

In a wrap-up published by Regula, the researcher observed that the problem is caused by a strange behavior he observed in a sandboxed macOS app that may launch any application that won’t inherit the main app’s sandbox profile.

According to ZDI, This vulnerability allows remote attackers to escape the sandbox on affected installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

“A sandboxed process may be able to circumvent sandbox restrictions.” reads the advisory published by Apple that addressed the flaw with improved environment sanitization.
“This vulnerability allows remote attackers to escape the sandbox on affected installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.” reads the report published by ZDI.
Click to expand...

The issue was reported to the vendor on December 22, 2021 and it was disclosed on August 15, 2022.

Regula focused his analysis on an Objective-C method of the Terminal.app.

“+[TTApplication isRunningInInstallEnvironment] will return YES when the __OSINSTALL_ENVIRONMENT environment variable was set.” wrote the expert. “So, when Terminal.app starts, some of the environment variables were not cleared when +[TTApplication isRunningInInstallEnvironment] returned YES. Great, with simple command injection I was able to execute code within the Terminal.app context without any sandbox!”
Click to expand...

Rasheed187 · Dec 3, 2022

Sounds like quite a serious ''privilege escalation'' flaw. I guess an attacker could use this to break out of the browser or Office sandbox. I don't know why Apple seems to downplay this flaw and describe it as expected behavior LOL.

Log in or Sign up

Expert published PoC exploit code for macOS sandbox escape flaw

guest Guest

Rasheed187 Registered Member

Log in or Sign up

Expert published PoC exploit code for macOS sandbox escape flaw

guest Guest

Rasheed187 Registered Member

Useful Searches