The Microsoft 365 Defender Research Team have released a security warning to macOS users about a vulnerability they have discovered in Apple’s App Sandbox. The vulnerability tracked as CVE-2022-26706 was first uncovered in October 2021, however a new Proof of Concept (PoC) has been released by Microsoft in two formats, one of which is describe as a “tweetable PoC” due to its simplicity. 

Release of these PoCs mean that users could be more at risk of this form of attack as malicious actors now have access to information on how to successfully exploit this flaw. This vulnerability is present in macOS versions prior to Monterey 12.4, and macOS Big Sur 11.6.6. Apple’s security update released in May this year included a patch for this sandbox escape vulnerability.  

The App Sandbox is the name for the access control technology that Apple asks all app developers to use in order to conform to the guidelines that allow apps to be distributed through the Mac App Store. As Microsoft list Office applications on the Mac App Store, they must use this technology to set the rules for their applications too. These can include the ability to read and write different file types, and the level of restrictions placed on the apps as to how much of the user data and system resources they have access to. Microsoft stated that they discovered this vulnerability while researching ways to detect and run malicious macros in Microsoft Office documents when running on macOS.  

Exploitation of CVE-2022-26706 involves the attacker creating code that can bypass the rules established in the sandbox, resulting in a sandbox escape. This gives the attacker the ability to gain elevation of privileges on the affected device, as well as the freedom to execute malicious commands and instal additional payloads. The attack works by taking advantage of the macOS Launch Services to run an open-stdin command in a Python file, which then allows the attacker to escape the sandbox, circumvent all applied restrictions of the sandbox, and execute arbitrary code.  

A similar sandbox escape vulnerability, CVE-2021-30864, was discovered last year by Perception Point, also with a very simple PoC. This was patched in September 2021, and then disclosed by Apple in January of this year. The patch for CVE-2022-26706 has been applied in the following versions: tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, and macOS Monterey 12.4. All users running the latest OS versions should be safe from this form of attack.