Get the latest tech news
Multiple new macOS sandbox escape vulnerabilities
This is a blog post for my presentation at the conference POC2024. The slides are uploaded here.
Through my research, I found that registering the XPC service to a sandboxed application’s PID domain is as simple as a single line of code: Next, I can create the symlink from the sandboxed application directly, or just assign the executable permission to the extracted macho by calling the API chmod. It can be abused to read an arbitrary file with extension “.png ”, and the retrieved data will be stored in a member variable of the “ INImage ” instance and replied to the XPC client.
Or read this on Hacker News
