Uncovering file quarantine and UX security issues in macOS apps ( .terminal, .fileloc and .url)

Post Reply
Shane1145
Posts: 1624
Joined: Wed Sep 25, 2024 2:31 pm

Uncovering file quarantine and UX security issues in macOS apps ( .terminal, .fileloc and .url)

Post by Shane1145 »

Popular macOS apps with a file-sharing functionality didn't delegate file quarantine to OS leading to File Quarantine bypass (Windows MOTW analogue) for downloaded files. The vulnerability has low/moderate impact, but it can be combined with other custom behaviours, and UX features to increase the severity.
During the research, I also discovered two "insecure features" in macOS: dangerous handling of .fileloc and .url shortcut files, those allow executing arbitrary local files by the full path at shortcut file opening. This behaviour allowed me to discover two Chrome and Firefox bugs: CVE-2020–6797, CVE-2020–6402


https://hackerone.com/reports/944025
Post Reply