Unpatched MacOS vulnerability lets remote attackers execute code

Crafted “inetloc” attachment when viewed via macOS Mail app.

Credit: Ax Sharma

Apple’s “fix” can easily be bypassed

The cause of the vulnerability is rather simple. An Internet shortcut file typically contains a URL. But, what happens if one includes a “file://” URL?

URLs beginning with “file://” rather than commonly seen “http://” or “https://” are used to retrieve files from within one’s own computer system. You can try doing this on your Mac now. Opening a local file on your computer with the Chrome or Safari web browser will automatically generate its equivalent file:// location in the address bar. And, Internet shortcuts or inetloc files can be easily crafted to point to “file://” URLs as opposed to HTTP ones.

Although Apple was notified of the flaw and, starting with Big Sur, blocks the inclusion of file:// URLs in Internet shortcuts, one can get around the block by changing the text case:

“Newer versions of macOS (from Big Sur) have blocked the file:// prefix (in the com.apple.generic-internet-location) however they did a case matching causing File:// or fIle:// to bypass the check,” explains Minchan.

I tested this theory on my macOS Big Sur 11.3.1 and 11.6 using the proof-of-concept (PoC) code provided by Minchan and can confirm the bug has indeed not been fully patched:

macOS RCE bug proof-of-concept code that has code to launch the Calculator app.

This snippet with just eight lines of code is what launched the Calculator shown above. But any skillful threat actor could modify this test code to execute outright malicious code on the victim’s machine. For example, Ars noticed more advanced payloads like “FiLe:///////////////bin/pwd” ran successfully.

Apple Mac users are warned to be cautious when opening .inetloc Internet shortcuts, especially ones that come in via email attachments.