Researcher chains macOS App Store flaws to root

A researcher detailed dylib hijacking in multiple macOS apps and an App Store installd bypass that let non-root users escalate to root, fixed by Apple in Mojave 10.14.5.

This is a technical research writeup rather than an active threat report. The author explores dylib hijacking vulnerabilities across numerous macOS applications (using Tresorit as a disclosed example), where weak or rpath-based dylib loading allows an attacker to plant malicious libraries that get loaded by legitimate signed applications, enabling code execution and persistence under the logged-in user's privileges.

The more significant finding is a privilege escalation chain abusing the macOS App Store installation daemon (installd), which runs as root. By creating symlinks in place of expected application folders (e.g., pointing to /usr/lib/cron/tabs, /Library/LaunchDaemons, /Library/StartupItems, or /etc) before triggering a reinstall via the App Store, an unprivileged admin user could redirect root-owned file writes to attacker-controlled locations, achieving root code execution via crontab entries, LaunchDaemons, or login hooks. The researcher built and published a legitimate-looking app ('Crontab Creator') to the App Store to prove the exploit path, successfully passing Apple's review process.

Apple partially fixed the crontab-folder redirection in Mojave 10.14.5 but the researcher found the broader symlink-redirection technique still worked against other protected directories, reporting a follow-up POC ('StartUp') targeting LaunchDaemons for root shell access via a bind shell. Apple did not assign a CVE, treating the issue as an enhancement rather than a security vulnerability, though they eventually fixed the underlying installd behavior in a later Mojave update and credited the researcher. No in-the-wild exploitation is reported; this is disclosed research with vendor acknowledgment.

Source reporting: https://objective-see.org/blog/blog_0x46.html