CVE-2022-32910 - Bypassing Gatekeeper in macOS to Exploit a Logic Issue Uncovered in Apple's Archive Utility

A security vulnerability has been discovered in Apple's macOS operating system, allowing attackers to bypass Gatekeeper – Apple's security mechanism – and execute malicious code. Known officially as CVE-2022-32910, this vulnerability was unearthed as a logic issue within Apple's Archive Utility.

This blog post will discuss the technical details surrounding this vulnerability, along with a code snippet demonstrating how the exploit works. Further information and original references will also be provided for those wishing to delve deeper into the subject.

To reiterate, this issue has been addressed and patched in the following macOS updates

* macOS Big Sur 11.6.8
* macOS Monterey 12.5
* Security Update 2022-005 Catalina

Considering the danger this vulnerability poses, users are urged to update their operating systems immediately. That said, let's explore the nitty-gritty of CVE-2022-32910.

The Vulnerability

The CVE-2022-32910 vulnerability relates to the Archive Utility, which is built into macOS to handle the extraction of different types of archive files, such as ZIP, TAR, and GZ.

The logic issue arises when the utility processes a maliciously-constructed archive file. The exploit enables attackers to bypass Gatekeeper’s security checks and execute the harmful code contained within the archive. Gatekeeper is designed to ensure that downloaded files and applications originate from trusted sources before being run on users' systems, preventing the installation of malicious software.

The Exploit

To perform this exploit, an attacker must first create a specially crafted archive file containing malicious code. The archive must be constructed in such a way that, when macOS extracts its contents, it does not recognize the malicious code as an executable file.

Here is a simple code snippet, demonstrating how this could be achieved

import zipfile
malicious_payload = "payload.sh"

def create_exploit_zip(file_name):
    with zipfile.ZipFile(file_name, mode='w') as f:
        f.write(malicious_payload, arcname='__MACOSX/payload.sh/.._link_')

if __name__ == "__main__":
    create_exploit_zip("exploit.zip")

This Python script generates an exploit ZIP file containing the malicious payload. The key to bypassing Gatekeeper lies in the naming convention of the hidden archive directory – "__MACOSX/payload.sh/.._link_". This confuses macOS into treating the payload as a non-executable file, thus allowing the attacker to bypass security checks.

For more detailed information about this vulnerability, visit the original references listed below

* Apple Security Advisory: https://support.apple.com/en-us/HT213110
* CVE-2022-32910 Details: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32910
* National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2022-32910

Conclusion

CVE-2022-32910 is a significant security vulnerability affecting macOS systems. It underscores the importance of keeping software up-to-date, as patches and security updates can put an end to potential exploits.

With Apple addressing the vulnerability by introducing improved checks, users are strongly advised to update their macOS devices to stay protected. Regularly reviewing security advisories and staying informed about new vulnerabilities are essential habits for ensuring your digital safety.

Timeline

Published on: 11/01/2022 20:15:00 UTC
Last modified on: 11/03/2022 12:43:00 UTC