Researcher chains macOS App Store flaws to root
A researcher detailed dylib hijacking in multiple macOS apps and an App Store installd bypass that let non-root users escalate to root, fixed by Apple in Mojave 10.14.5.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
This is a technical research writeup rather than an active threat report. The author explores dylib hijacking vulnerabilities across numerous macOS applications (using Tresorit as a disclosed example), where weak or rpath-based dylib loading allows an attacker to plant malicious libraries that get loaded by legitimate signed applications, enabling code execution and persistence under the logged-in user's privileges.
The more significant finding is a privilege escalation chain abusing the macOS App Store installation daemon (installd), which runs as root. By creating symlinks in place of expected application folders (e.g., pointing to /usr/lib/cron/tabs, /Library/LaunchDaemons, /Library/StartupItems, or /etc) before triggering a reinstall via the App Store, an unprivileged admin user could redirect root-owned file writes to attacker-controlled locations, achieving root code execution via crontab entries, LaunchDaemons, or login hooks. The researcher built and published a legitimate-looking app ('Crontab Creator') to the App Store to prove the exploit path, successfully passing Apple's review process.
Apple partially fixed the crontab-folder redirection in Mojave 10.14.5 but the researcher found the broader symlink-redirection technique still worked against other protected directories, reporting a follow-up POC ('StartUp') targeting LaunchDaemons for root shell access via a bind shell. Apple did not assign a CVE, treating the issue as an enhancement rather than a security vulnerability, though they eventually fixed the underlying installd behavior in a later Mojave update and credited the researcher. No in-the-wild exploitation is reported; this is disclosed research with vendor acknowledgment.
Source reporting: https://objective-see.org/blog/blog_0x46.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,570 reports from 147 sources, 725 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs