Researcher chains CVE-2019-1457 to bypass macOS notarization

A researcher built a full exploit chain from a patched Office macro bug, a new sandbox escape, and a notarization bypass to silently and persistently backdoor fully-patched macOS Catalina.

This is a Defcon talk writeup from Objective-See detailing both in-the-wild macOS macro-based attacks and a novel proof-of-concept exploit chain. The author first reviews three real-world campaigns (2017-2019) that used malicious Office macros on macOS to deploy the EmPyre post-exploitation agent and, in the case of the Lazarus Group, a custom binary implant fetched from nzssdm[.]com. These in-the-wild attacks are described as largely neutered by existing mitigations: macro warning prompts, application sandboxing, and Catalina's notarization checks.

The core of the talk is a researcher-constructed exploit chain that defeats all three mitigations. It begins with CVE-2019-1457, a Microsoft Office SYLK/XLM macro auto-execution flaw (originally discovered by Pieter Ceelen and Stan Hegt) that fires without any user prompt when 'Disable all macros without notification' is set. From there, the researcher chains a new sandbox escape — abusing macOS's ability to persist a Login Item from within the sandboxed Office process — with a creative notarization bypass: persisting a zip archive as a login item, which Archive Utility auto-extracts outside the sandbox, silently dropping a Launch Agent that spawns an interactive reverse shell via /bin/bash (a trusted, already-notarized system binary). The result is full, alert-free, persistent compromise of a fully patched macOS Catalina system triggered solely by opening a malicious document, demonstrated by installing a repurposed OSX.WindTail backdoor via the resulting shell.

Microsoft patched the macro auto-execution issue as CVE-2019-1457 and attributed the remaining sandbox/notarization issues to Apple; Apple silently fixed the bugs in macOS 10.15.3 without assigning a CVE. The author closes by showing that behavior-based heuristics — monitoring for Office applications spawning child processes (curl, python) and monitoring persistence locations such as Login Items and Launch Agents — can generically detect both the in-the-wild attacks and this novel exploit chain.

title: Office Application Spawning Shell Interpreter or Download Tool
description: Detects Microsoft Office applications (Word, Excel, PowerPoint) on macOS
  spawning shell interpreters or download utilities such as curl, python, or bash.
  Typical of macro-based malware executing payload code or establishing interactive
  shells.
tags:
- attack.execution
- attack.t1105
- attack.t1059.005
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|endswith:
    - /Microsoft Word
    - /Microsoft Excel
    - /Microsoft PowerPoint
    Image|endswith:
    - /curl
    - /python
    - /bash
    - /sh
  filter_legitimate_macros:
    CommandLine|contains:
    - help
    - --version
  condition: selection and not filter_legitimate_macros
falsepositives:
- Office add-ins that legitimately shell out to download or execute scripts
- User-authored macros in trusted environments that invoke system utilities
level: high
id: 38d14570-3759-52be-9470-bff67143b668
status: experimental
author: Vorant

title: Persistence via Office-Spawned Login Item Registration
description: Detects Microsoft Office applications spawning processes that register
  Login Items or modify LaunchServices preferences. Office macro sandbox escapes often
  abuse the ability to add Login Items, persisting ZIP archives or shell scripts that
  execute on login.
tags:
- attack.persistence
- attack.t1547.015
logsource:
  category: process_creation
  product: macos
detection:
  selection_defaults:
    ParentImage|endswith:
    - /Microsoft Word
    - /Microsoft Excel
    - /Microsoft PowerPoint
    Image|endswith: /defaults
    CommandLine|contains:
    - write com.apple.loginitems
    - LSSharedFileListItemData
  selection_launchctl:
    ParentImage|endswith:
    - /Microsoft Word
    - /Microsoft Excel
    - /Microsoft PowerPoint
    Image|endswith: /launchctl
    CommandLine|contains: load
  condition: 1 of selection_*
falsepositives:
- Office add-in installers that register their own helper utilities as Login Items
level: high
id: 6c194881-00cf-5ec1-a386-1fba1cf8427b
status: experimental
author: Vorant

title: Launch Agent Creation from Extracted Archive in Home Directory
description: Detects creation of Launch Agent property list files in ~/Library/LaunchAgents
  directory. Combined with archive auto-extraction, this indicates a notarization
  bypass chain where a ZIP archive persisted as a Login Item is auto-extracted by
  Archive Utility outside the sandbox, dropping an unsigned Launch Agent that gains
  persistence.
tags:
- attack.persistence
- attack.t1543.001
- attack.t1211
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|contains: /Library/LaunchAgents/
    TargetFilename|endswith: .plist
    Image|endswith:
    - /Archive Utility
    - /ditto
    - /unzip
    - /tar
  filter_apple_updates:
    TargetFilename|contains: com.apple
  condition: selection and not filter_apple_updates
falsepositives:
- Legitimate software installers that auto-extract and register Launch Agents
- User-initiated installation of third-party tools via DMG or ZIP
level: medium
id: 1fe310b2-a63a-5b3d-ad37-5939d65fc44a
status: experimental
author: Vorant

Source reporting: https://objective-see.org/blog/blog_0x4B.html