Symlink Exploit in iOS and macOS Enables TCC Bypass

A vulnerability in Apple’s iOS and macOS has highlighted a serious flaw that allowed attackers to bypass the Transparency, Consent, and Control (TCC) framework, potentially exposing users’ sensitive data. This vulnerability, now patched, underscores the persistent risks in device security despite Apple’s robust privacy architecture.

Overview

The flaw, designated CVE-2024-44131 with a CVSS score of 5.3, resides in the FileProvider component. Apple has addressed the issue through improved symlink validation in iOS 18, iPadOS 18, and macOS Sequoia 15.

Discovered by Jamf Threat Labs, the exploit could enable a malicious app installed on an Apple device to access sensitive data without user consent. The TCC framework typically safeguards against such risks by controlling app permissions for accessing sensitive features like location data, contacts, and camera functions.

How the Exploit Works

The core of the vulnerability lies in how file operations are managed through the fileproviderd daemon, responsible for handling file tasks linked to iCloud and third-party cloud services. When a user moves or copies files using the Files app, the malicious app could exploit a race condition by creating deceptive symlinks.

Here’s a breakdown of the attack process:

1. File Monitoring: The attacker monitors user actions involving file transfers in the Files app.

2. Symlink Injection: Once a transfer begins, the attacker inserts a symlink into the transfer process, redirecting files to a malicious location.

3. Data Exfiltration: The hijacked files can then be uploaded to a remote server controlled by the attacker.

By exploiting this process, attackers could access data stored in iCloud backups, including files from both Apple’s native apps and third-party services.

Impact on Device Security

The most alarming aspect of this flaw is its stealth. Since the attack bypasses the TCC framework, users receive no system alerts or prompts indicating unauthorized access. This poses a severe risk to sensitive data such as:

• Files and folders

• Health data

• Microphone and camera access

However, Jamf Threat Labs noted that the extent of the attack depends on the permissions of the targeted process. Certain data types, like files protected by unique UUIDs or those accessed through specific APIs, remain secure.

Apple’s Response and Patches

Apple acted swiftly by releasing patches across its ecosystem, addressing multiple vulnerabilities:

• WebKit Issues: Four WebKit-related flaws that could lead to memory corruption and process crashes.

• Kernel Exploit (CVE-2024-54529): A logic vulnerability in the Audio component that could allow apps to execute arbitrary code with kernel privileges.

• Safari Private Relay Bug (CVE-2024-44246): A flaw that exposed users’ IP addresses despite Private Relay being enabled.

Apple enhanced the routing of Safari-originated requests to resolve the Safari issue and improved validation procedures across the board.