Apple Patches macOS Keychain Credential Leak Bug

A flaw in macOS's NetAuthAgent MIG server let unprivileged local processes proxy keychain queries, leaking saved file-server credentials and iCloud API tokens.

Security researcher Noah Gregory disclosed CVE-2024-54471, a vulnerability in macOS's NetAuthAgent daemon that Apple patched in macOS Sequoia 15.1, Sonoma 14.7.1, and Ventura 13.7.1 (October 28, 2024). NetAuthAgent exposes a Mach Interface Generator (MIG) server under the bootstrap service name com.apple.netauth.user.gui that handles credentials for file-sharing protocols (FTP, Samba, WebDAV). Prior to the patch, none of its routines verified the sender of incoming Mach messages, meaning any local process that obtained a send right to the service could invoke privileged routines to read, create, or overwrite keychain-stored 'internet password' items — effectively proxying arbitrary keychain queries without authorization checks.

The researcher demonstrated that a malicious unprivileged process could enumerate keychain items NetAuthAgent has access to and retrieve their plaintext credentials, which in corporate environments could include SSO credentials providing broader lateral access. More critically, the exploit chain also reached a system keychain item unrelated to file servers that, once decrypted, exposed iCloud API tokens. Building on prior research by Wojciech Reguła, the author showed these tokens could be used to access a victim's Contacts, Calendars, and other iCloud-synced data, and speculated they could potentially assist forensic tooling in decrypting iCloud backups. The vulnerability also allowed covert data storage in the keychain, invisible to typical endpoint security monitoring, and could enable credential-injection social engineering scenarios.

This is a locally-exploitable design flaw requiring existing code execution on the target device (no remote vector or public exploitation was reported); the article is a researcher write-up published after Apple's fix rather than an active-threat advisory. No indicators of compromise, campaigns, or threat actor involvement are associated with this disclosure — it represents a patched OS-level vulnerability with significant credential and privacy exposure potential if it had been exploited pre-patch.

Source reporting: https://objective-see.org/blog/blog_0x7E.html