VORANT. Threat Intelligence Sign in Get the full feed

Apple Patches macOS Keychain Credential Leak Bug

elevated vulnerability educationtechnology

A flaw in macOS's NetAuthAgent MIG server let unprivileged local processes proxy keychain queries, leaking saved file-server credentials and iCloud API tokens.

Security researcher Noah Gregory disclosed CVE-2024-54471, a vulnerability in macOS's NetAuthAgent daemon that Apple patched in macOS Sequoia 15.1, Sonoma 14.7.1, and Ventura 13.7.1 (October 28, 2024). NetAuthAgent exposes a Mach Interface Generator (MIG) server under the bootstrap service name com.apple.netauth.user.gui that handles credentials for file-sharing protocols (FTP, Samba, WebDAV). Prior to the patch, none of its routines verified the sender of incoming Mach messages, meaning any local process that obtained a send right to the service could invoke privileged routines to read, create, or overwrite keychain-stored 'internet password' items — effectively proxying arbitrary keychain queries without authorization checks.

The researcher demonstrated that a malicious unprivileged process could enumerate keychain items NetAuthAgent has access to and retrieve their plaintext credentials, which in corporate environments could include SSO credentials providing broader lateral access. More critically, the exploit chain also reached a system keychain item unrelated to file servers that, once decrypted, exposed iCloud API tokens. Building on prior research by Wojciech Reguła, the author showed these tokens could be used to access a victim's Contacts, Calendars, and other iCloud-synced data, and speculated they could potentially assist forensic tooling in decrypting iCloud backups. The vulnerability also allowed covert data storage in the keychain, invisible to typical endpoint security monitoring, and could enable credential-injection social engineering scenarios.

This is a locally-exploitable design flaw requiring existing code execution on the target device (no remote vector or public exploitation was reported); the article is a researcher write-up published after Apple's fix rather than an active-threat advisory. No indicators of compromise, campaigns, or threat actor involvement are associated with this disclosure — it represents a patched OS-level vulnerability with significant credential and privacy exposure potential if it had been exploited pre-patch.

Mentioned in this report

Vulnerabilities CVE-2024-54471

Detection guidance

Unauthorized Keychain Access via NetAuthAgent Mach Interface

ATT&CK T1552

Detects attempts to interact with the com.apple.netauth.user.gui Mach bootstrap service to read or enumerate keychain credentials without proper authorization. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unauthorized Keychain Access via NetAuthAgent Mach Interface
description: Detects attempts to communicate with the com.apple.netauth.user.gui Mach
  bootstrap service for unauthorized keychain credential enumeration or extraction.
  This service handles credentials for file-sharing protocols (FTP, Samba, WebDAV)
  and internet passwords stored in the system keychain. Exploit of CVE-2024-54471
  involves sending Mach messages to this service from unprivileged processes to bypass
  authorization checks.
tags:
- attack.credential-access
- attack.t1552
- attack.t1555.001
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains:
    - com.apple.netauth.user.gui
    - NetAuthAgent
  filter_system_services:
    ParentImage|endswith:
    - /launchd
    - /SecurityAgent
    - /UserNotificationCenter
  condition: selection and not filter_system_services
falsepositives:
- Legitimate file-sharing protocol authentication during normal SMB/WebDAV mounts
- System processes during credential caching operations
level: high
id: 6e091d3a-c969-5e79-89da-91b127f916d3
status: experimental
author: Vorant

Keychain Internet Password Item Access Outside Normal Workflow

ATT&CK T1555.001

Detects non-system processes accessing keychain internet password items, particularly those stored by NetAuthAgent for file-sharing protocols or iCloud credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Keychain Internet Password Item Access Outside Normal Workflow
description: Detects suspicious access patterns to macOS keychain internet password
  items (kSecClassInternetPassword) from processes outside the normal authorization
  chain. CVE-2024-54471 exploitation involves reading plaintext credentials from keychain
  items accessed through NetAuthAgent without proper sender verification. Focuses
  on unexpected process access to keychain storage where credentials for FTP, Samba,
  WebDAV, or iCloud tokens might be cached.
tags:
- attack.credential-access
- attack.t1555.001
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains:
    - security find-internet-password
    - kSecClassInternetPassword
  filter_legitimate_tools:
    ParentImage|endswith:
    - /Finder
    - /System/Library/CoreServices
    - /Applications/Utilities
    Image|endswith:
    - /security
  filter_authorized_processes:
    Image|endswith:
    - /Safari
    - /Mail
    - /System/Library/PrivateFrameworks
  condition: selection and not (filter_legitimate_tools or filter_authorized_processes)
falsepositives:
- System utilities querying keychain for legitimate credential management
- Third-party password managers enumerating stored credentials
level: medium
id: 7a185a54-e22a-514d-b483-087be6f93e72
status: experimental
author: Vorant

Credential Injection via Keychain Write Operations

ATT&CK T1078

Detects suspicious write operations to keychain credential storage that could indicate credential injection attacks using NetAuthAgent's unchecked Mach interface. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Credential Injection via Keychain Write Operations
description: Detects unauthorized writes to macOS keychain credential items, particularly
  internet passwords stored in the system keychain. CVE-2024-54471 allowed unprivileged
  processes to create or overwrite keychain items through NetAuthAgent's Mach interface
  without authorization verification. This detection focuses on non-system processes
  attempting to write new credentials or modify existing ones, which could enable
  social engineering or lateral movement via injected credentials.
tags:
- attack.credential-access
- attack.t1078
- attack.t1555.001
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains:
    - security add-internet-password
    - security add-generic-password
    - kSecAttrAccount
  filter_system_administration:
    User: root
    ParentImage|endswith:
    - /System/Library
    - /usr/bin/security
  filter_credential_managers:
    Image|endswith:
    - /1Password
    - /Bitwarden
    - /LastPass
  condition: selection and not (filter_system_administration or filter_credential_managers)
falsepositives:
- Legitimate password manager operations storing encrypted credentials
- User-initiated keychain credential updates via system settings
level: medium
id: 7a1053b5-f669-5e14-85ec-0f27104e35aa
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x7E.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free