This means that any local attacker (local for code execution, not necessarily physical access) could modify these files and potentially escalate to root privileges during the installation process. In this advisory, they discuss an issue where files extracted to Installer Sandbox directories retained the permissions of a lower-privileged user, even when the installer itself was running with root privileges. In July 2020, NCC Group posted their advisory for CVE-2020–9817. Issue 1: Usage of Insecure Directories During Elevated Installations The primary issue being discussed here occurs when these scripts - running as root - read from and write to locations that a normal, lower-privileged user has control over. There is also the case of unattended installations automatically doing this, but we will not be covering that in this post. If the installer itself requires elevated privileges for any reason, such as setting up a system-level Launch Daemon for an auto-updater service, the installer will prompt the user for permission to elevate privileges to root.

These are scripts that run before and after the actual application files are copied to their final destination on a given system. Most notable of these features are preinstall and postinstall scripts. To recap from the previous blog, macOS installers have a variety of convenience features that allow developers to customize the installation process for their applications.

Below you will find full explanations of these flaws as well as proofs-of-concept that can be integrated into your existing post-exploitation arsenals. We wrote to Microsoft to recommend a fix for the flaw in their installer.īoth companies have rejected these submissions and suggestions. We wrote to Apple to recommend implementing a fix similar to what they did for CVE-2020–9817 and explained the additional LPE mechanism discovered. During our research, we noticed yet another of the aforementioned flaws in the Microsoft Teams installer and in the process of auditing it, discovered another generalized flaw with macOS package installers.įrustrated by the prevalence of these issues, we decided to write them up and make separate reports to both Apple and Microsoft. Over the last couple of months, as my team looked into other targets, we kept an eye on the installers of applications we were using and interacting with regularly. Back in December, we wrote about attacking macOS installers.

Teams mac installer