# Researcher chains CVE-2019-1457 to bypass macOS notarization

Published: 2020-08-04 · Severity: medium
Canonical: https://vorant.io/reports/2ad64e76-17d4-5d8c-a65d-23fcb1cc721c/researcher-chains-cve-2019-1457-to-bypass-macos-notarization

> A researcher built a full exploit chain from a patched Office macro bug, a new sandbox escape, and a notarization bypass to silently and persistently backdoor fully-patched macOS Catalina.

This is a Defcon talk writeup from Objective-See detailing both in-the-wild macOS macro-based attacks and a novel proof-of-concept exploit chain. The author first reviews three real-world campaigns (2017-2019) that used malicious Office macros on macOS to deploy the EmPyre post-exploitation agent and, in the case of the Lazarus Group, a custom binary implant fetched from nzssdm[.]com. These in-the-wild attacks are described as largely neutered by existing mitigations: macro warning prompts, application sandboxing, and Catalina's notarization checks.

The core of the talk is a researcher-constructed exploit chain that defeats all three mitigations. It begins with CVE-2019-1457, a Microsoft Office SYLK/XLM macro auto-execution flaw (originally discovered by Pieter Ceelen and Stan Hegt) that fires without any user prompt when 'Disable all macros without notification' is set. From there, the researcher chains a new sandbox escape — abusing macOS's ability to persist a Login Item from within the sandboxed Office process — with a creative notarization bypass: persisting a zip archive as a login item, which Archive Utility auto-extracts outside the sandbox, silently dropping a Launch Agent that spawns an interactive reverse shell via /bin/bash (a trusted, already-notarized system binary). The result is full, alert-free, persistent compromise of a fully patched macOS Catalina system triggered solely by opening a malicious document, demonstrated by installing a repurposed OSX.WindTail backdoor via the resulting shell.

Microsoft patched the macro auto-execution issue as CVE-2019-1457 and attributed the remaining sandbox/notarization issues to Apple; Apple silently fixed the bugs in macOS 10.15.3 without assigning a CVE. The author closes by showing that behavior-based heuristics — monitoring for Office applications spawning child processes (curl, python) and monitoring persistence locations such as Login Items and Launch Agents — can generically detect both the in-the-wild attacks and this novel exploit chain.

## Mentioned in this report

- Vulnerabilities: CVE-2019-1457
- Threat actors: Lazarus Group
- Malware: EmPyre, OSX.WindTail, mt.dat implant

Source reporting: https://objective-see.org/blog/blog_0x4B.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2ad64e76-17d4-5d8c-a65d-23fcb1cc721c/researcher-chains-cve-2019-1457-to-bypass-macos-notarization.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup