VORANT. Threat Intelligence Research Create a free account

Apple Patches macOS Keychain Credential Leak Bug

Published Vorant ratingelevated vulnerability EducationTechnology

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

A flaw in macOS's NetAuthAgent MIG server let unprivileged local processes proxy keychain queries, leaking saved file-server credentials and iCloud API tokens.

Sourceobjective-see.org — open the original

What to check

Applies to
The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
Exploitation
No exploitation in the wild and no public exploit is recorded for the CVEs named.

Security researcher Noah Gregory disclosed CVE-2024-54471, a vulnerability in macOS's NetAuthAgent daemon that Apple patched in macOS Sequoia 15.1, Sonoma 14.7.1, and Ventura 13.7.1 (October 28, 2024). NetAuthAgent exposes a Mach Interface Generator (MIG) server under the bootstrap service name com.apple.netauth.user.gui that handles credentials for file-sharing protocols (FTP, Samba, WebDAV). Prior to the patch, none of its routines verified the sender of incoming Mach messages, meaning any local process that obtained a send right to the service could invoke privileged routines to read, create, or overwrite keychain-stored 'internet password' items — effectively proxying arbitrary keychain queries without authorization checks.

The researcher demonstrated that a malicious unprivileged process could enumerate keychain items NetAuthAgent has access to and retrieve their plaintext credentials, which in corporate environments could include SSO credentials providing broader lateral access. More critically, the exploit chain also reached a system keychain item unrelated to file servers that, once decrypted, exposed iCloud API tokens. Building on prior research by Wojciech Reguła, the author showed these tokens could be used to access a victim's Contacts, Calendars, and other iCloud-synced data, and speculated they could potentially assist forensic tooling in decrypting iCloud backups. The vulnerability also allowed covert data storage in the keychain, invisible to typical endpoint security monitoring, and could enable credential-injection social engineering scenarios.

This is a locally-exploitable design flaw requiring existing code execution on the target device (no remote vector or public exploitation was reported); the article is a researcher write-up published after Apple's fix rather than an active-threat advisory. No indicators of compromise, campaigns, or threat actor involvement are associated with this disclosure — it represents a patched OS-level vulnerability with significant credential and privacy exposure potential if it had been exploited pre-patch.

Mentioned in this report

Vulnerabilities CVE-2024-54471

Detection guidance

Unauthorized Keychain Access via NetAuthAgent Mach Interface

ATT&CK T1552 · status experimental · needs macos process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects attempts to interact with the com.apple.netauth.user.gui Mach bootstrap service to read or enumerate keychain credentials without proper authorization. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unauthorized Keychain Access via NetAuthAgent Mach Interface
description: Detects attempts to communicate with the com.apple.netauth.user.gui Mach
  bootstrap service for unauthorized keychain credential enumeration or extraction.
  This service handles credentials for file-sharing protocols (FTP, Samba, WebDAV)
  and internet passwords stored in the system keychain. Exploit of CVE-2024-54471
  involves sending Mach messages to this service from unprivileged processes to bypass
  authorization checks.
tags:
- attack.credential-access
- attack.t1552
- attack.t1555.001
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains:
    - com.apple.netauth.user.gui
    - NetAuthAgent
  filter_system_services:
    ParentImage|endswith:
    - /launchd
    - /SecurityAgent
    - /UserNotificationCenter
  condition: selection and not filter_system_services
falsepositives:
- Legitimate file-sharing protocol authentication during normal SMB/WebDAV mounts
- System processes during credential caching operations
level: high
id: 6e091d3a-c969-5e79-89da-91b127f916d3
status: experimental
author: Vorant

Keychain Internet Password Item Access Outside Normal Workflow

ATT&CK T1555.001 · status experimental · needs macos process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects non-system processes accessing keychain internet password items, particularly those stored by NetAuthAgent for file-sharing protocols or iCloud credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Keychain Internet Password Item Access Outside Normal Workflow
description: Detects suspicious access patterns to macOS keychain internet password
  items (kSecClassInternetPassword) from processes outside the normal authorization
  chain. CVE-2024-54471 exploitation involves reading plaintext credentials from keychain
  items accessed through NetAuthAgent without proper sender verification. Focuses
  on unexpected process access to keychain storage where credentials for FTP, Samba,
  WebDAV, or iCloud tokens might be cached.
tags:
- attack.credential-access
- attack.t1555.001
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains:
    - security find-internet-password
    - kSecClassInternetPassword
  filter_legitimate_tools:
    ParentImage|endswith:
    - /Finder
    - /System/Library/CoreServices
    - /Applications/Utilities
    Image|endswith:
    - /security
  filter_authorized_processes:
    Image|endswith:
    - /Safari
    - /Mail
    - /System/Library/PrivateFrameworks
  condition: selection and not (filter_legitimate_tools or filter_authorized_processes)
falsepositives:
- System utilities querying keychain for legitimate credential management
- Third-party password managers enumerating stored credentials
level: medium
id: 7a185a54-e22a-514d-b483-087be6f93e72
status: experimental
author: Vorant

Credential Injection via Keychain Write Operations

ATT&CK T1078 · status experimental · needs macos process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects suspicious write operations to keychain credential storage that could indicate credential injection attacks using NetAuthAgent's unchecked Mach interface. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Credential Injection via Keychain Write Operations
description: Detects unauthorized writes to macOS keychain credential items, particularly
  internet passwords stored in the system keychain. CVE-2024-54471 allowed unprivileged
  processes to create or overwrite keychain items through NetAuthAgent's Mach interface
  without authorization verification. This detection focuses on non-system processes
  attempting to write new credentials or modify existing ones, which could enable
  social engineering or lateral movement via injected credentials.
tags:
- attack.credential-access
- attack.t1078
- attack.t1555.001
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains:
    - security add-internet-password
    - security add-generic-password
    - kSecAttrAccount
  filter_system_administration:
    User: root
    ParentImage|endswith:
    - /System/Library
    - /usr/bin/security
  filter_credential_managers:
    Image|endswith:
    - /1Password
    - /Bitwarden
    - /LastPass
  condition: selection and not (filter_system_administration or filter_credential_managers)
falsepositives:
- Legitimate password manager operations storing encrypted credentials
- User-initiated keychain credential updates via system settings
level: medium
id: 7a1053b5-f669-5e14-85ec-0f27104e35aa
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x7E.html

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account   What it costs