Zero-Day macOS Flaw Lets Remote Attackers Execute Code

A code execution bug in Apple’s macOS allows remote attackers to run arbitrary commands on your device.

Independent security researcher Park Minchan has discovered a vulnerability in the macOS that lets threat actors execute commands on your computer, explains a new report from Bleeping Computer. Shortcut files that have the “inetloc” extension are capable of embedding commands inside. The flaw impacts macOS Big Sur and prior versions.

“A vulnerability in the way macOS processes inetloc files causes it to run commands embedded inside, the commands it runs can be local to the macOS allowing the execution of arbitrary commands by the user without any warning / prompts,” explains Minchan. “Originally, inetloc files are shortcuts to an Internet location, such as an RSS feed or a telnet location; and contain the server address and possibly a username and password for SSH and telnet connections; can be created by typing a URL in a text editor and dragging the text to the Desktop.”

Minchan says this is possible due to a bug in how macOS handles Internet location (inetloc) files which causes it to run any commands embedded inside. Normally, these are system-wide bookmarks used to open online resources or local files, but in this case, they can be leveraged by an attacker to execute malicious code without any warning or prompts being shown to the user on the target Mac.

This can be done by changing the prefacing link in an inetloc file with “file://,” and all it takes to perform the exploit is one click from the user.

Minchan warned Apple about the vulnerability, and the company issued a patch. However, Apple did try to patch the flaw on macOS Big Sur, but it did so silently without assigning it a CVE and overlooked the fact that using “File://” or “fIle://” (simply mangling the value) can work just as well as “file://.”

BleepingComputer went one step ahead and tested a proof-of-concept exploit shared by Minchan, which worked just as the researcher had observed in his disclosure.