Researcher chains CVE-2019-1457 to bypass macOS notarization

A researcher built a full exploit chain from a patched Office macro bug, a new sandbox escape, and a notarization bypass to silently and persistently backdoor fully-patched macOS Catalina.

This is a Defcon talk writeup from Objective-See detailing both in-the-wild macOS macro-based attacks and a novel proof-of-concept exploit chain. The author first reviews three real-world campaigns (2017-2019) that used malicious Office macros on macOS to deploy the EmPyre post-exploitation agent and, in the case of the Lazarus Group, a custom binary implant fetched from nzssdm[.]com. These in-the-wild attacks are described as largely neutered by existing mitigations: macro warning prompts, application sandboxing, and Catalina's notarization checks.

The core of the talk is a researcher-constructed exploit chain that defeats all three mitigations. It begins with CVE-2019-1457, a Microsoft Office SYLK/XLM macro auto-execution flaw (originally discovered by Pieter Ceelen and Stan Hegt) that fires without any user prompt when 'Disable all macros without notification' is set. From there, the researcher chains a new sandbox escape — abusing macOS's ability to persist a Login Item from within the sandboxed Office process — with a creative notarization bypass: persisting a zip archive as a login item, which Archive Utility auto-extracts outside the sandbox, silently dropping a Launch Agent that spawns an interactive reverse shell via /bin/bash (a trusted, already-notarized system binary). The result is full, alert-free, persistent compromise of a fully patched macOS Catalina system triggered solely by opening a malicious document, demonstrated by installing a repurposed OSX.WindTail backdoor via the resulting shell.

Microsoft patched the macro auto-execution issue as CVE-2019-1457 and attributed the remaining sandbox/notarization issues to Apple; Apple silently fixed the bugs in macOS 10.15.3 without assigning a CVE. The author closes by showing that behavior-based heuristics — monitoring for Office applications spawning child processes (curl, python) and monitoring persistence locations such as Login Items and Launch Agents — can generically detect both the in-the-wild attacks and this novel exploit chain.

Source reporting: https://objective-see.org/blog/blog_0x4B.html