- Security researchers found a way to exfiltrate sensitive data through FileProvider
- The bug abuses the framework’s elevated privileges
- Apple patch address issue with improved validation of symbolic links
Apple has patched a hole in iOS and macOS which could have been abused to steal sensitive data from victims.
Cybersecurity researchers from Jamf Threat Labs recently discovered, and reported, a vulnerability in FileProvider, a framework in macOS and iOS that enables apps to manage and access files stored on remote servers or locally.
Tracked as CVE-2024-44131, and carrying a severity score of 5.3, the vulnerability stems from the framework’s elevated privileges, which can be abused to move files, and even upload them to a remote server under the attackers’ control.
Manipulating symlinks
The vulnerability bypasses Apple’s Transparency, Consent, and Control (TCC) framework, often described as a “critical security protection” mechanism for Apple devices.
“This TCC bypass allows unauthorized access to files and folders, Health data, the microphone or camera, and more without alerting users,” Jamf said. “This undermines user trust in the security of iOS devices and exposes personal data to risk.”
In theory, if a threat actor could get a malicious app running in an Apple device, it could intercept user action that moves, or copies files within the FIles app, and send them to a place under their control.
“Specifically, when a user moves or copies files or directories using Files.app within a directory accessible by a malicious app running in the background, the attacker can manipulate symlinks to deceive the Files app,” Jamf added. “The new symlink attack method first copies an innocent file, providing a detectable signal to a malicious process that the copying has started. Then, a symlink is inserted after the copying process is already underway, effectively bypassing the symlink check.”
Apple fixed the bug in iOS 18, iPadOS 18, and macOS Sequoia 15, with improved validation of symbolic links (symlinks), and advised users to apply the patch as soon as possible.
Via The Hacker News