Unpatched Apple Zero-Day in macOS Finder Allows Code Execution

A zero-day security vulnerability in Apple’s macOS Finder system could allow remote attackers to trick users into running arbitrary commands, according to researchers – and a silent patch hasn’t fixed it.

For those not in the Apple camp, the macOS Finder is the default file manager and GUI front-end used on all Macintosh operating systems. It’s the first thing users see upon booting, and it governs the launching of other applications and the overall user management of files, disks and network volumes. It’s the overlord application for everything else on the Mac, in other words.

According to an SSD Secure Disclosure advisory this week, the vulnerability exists in the way macOS Finder handles .Inetloc files. Inetloc files are Apple-specific, and function as shortcuts to internet locations, such as an RSS feed or a telnet location; or they can be used to open documents locally on someone’s Mac within a browser using the “file://” format (in place of http://). It’s the latter function that’s at issue with the zero day, researchers said.

In an exploit scenario for the bug, the .Inetloc files can be specially crafted to contain embedded commands. The crafted files can then be attached to (or linked in) malicious emails, researchers added – and if users are socially engineered into clicking on them, those commands embedded inside automatically execute in stealth mode, with no alert or prompt given to victims.

“A vulnerability in the way macOS processes .Inetloc files causes it to run commands embedded inside, the commands it runs can be local to the macOS allowing the execution of arbitrary commands by the user without any warning/prompts,” according to the advisory.

It’s a simple exploitation scenario – as demoed in an SSD video included in the alert.

Independent security researcher Park Minchan reported the vulnerability to SSD, noting that the bug affects macOS Big Sur edition and all those prior it. In response, Apple chose not to issue a CVE, and silently patched the issue – except the fix was botched, researchers said.

“The vendor has notified us that file:// [function] has been silently patched,” the advisory explained. However, researchers added that the bug can still be exploited by using a mangled value, like FiLe:// in the file’s execution routine.

“Newer versions of macOS (from Big Sur) have blocked the file:// prefix…however they did case-matching causing File:// or fIle:// to bypass the check,” they explained.

“We…have not received any response from them since the report has been made,” according to the advisory. “As far as we know, at the moment, the vulnerability has not been patched.”

There’s no word on whether it’s been exploited in the wild, and Apple did not immediately return a request for comment.

The computing giant has had its share of zero days this year. In May, it patched a critical bug in macOS that could be exploited to take screenshots of someone’s computer and capture images of their activity within applications or on video conferences without that person knowing. In July, it patched an actively exploited zero-day flaw in both its iOS and macOS platforms that could allow attackers to take over an affected system. And earlier this month, it rushed an emergency patch for the “ForcedEntry” zero-click zero-day, which was being exploited by NSO Group to install spyware.

Rule #1 of Linux Security: No cybersecurity solution is viable if you don’t have the basics down. JOIN Threatpost and Linux security pros at Uptycs for a LIVE roundtable on the 4 Golden Rules of Linux Security. Your top takeaway will be a Linux roadmap to getting the basics right! REGISTER NOW and join the LIVE event on Sept. 29 at Noon EST. Joining Threatpost is Uptycs’ Ben Montour and Rishi Kant who will spell out Linux security best practices and take your most pressing questions in real time.