Hackers could use your Mac to exploit Microsoft Word security flaws

Microsoft has shed light on a flaw in macOS that, if exploited, could allow threat actors to run arbitrary code, remotely. The flaw, tracked as CVE-2022-26706, enables the circumvention of macOS App Sandbox rules, enabling macros in Word documents to run.

For years now, macros have been used by numerous threat actors, to trick people into downloading malware (opens in new tab), or ransomware, on their endpoints. It has gotten to a point when Microsoft decided to disable macros on all files outside the trusted network and to make it quite difficult for the average Word user to enable them.

Now, Microsoft is warning that the practice can also be used on MacOS devices, as well:

Executing arbitrary commands

“Despite the security restrictions imposed by the App Sandbox’s rules on applications, it’s possible for attackers to bypass the said rules and let malicious codes “escape” the sandbox and execute arbitrary commands on an affected device,” the company explained.

The flaw was discovered by the Microsoft 365 Defender Research Team and reportedly fixed by Apple on May 16.

App Sandbox is a technology embedded in macOS, that manages app access control. As the name suggests, its goal is to contain any potential damage that a malicious app can do, and to safeguard sensitive data.

The problem starts with Word’s backward compatibility. To make sure it works, the app can read or write files with an “~$” refix. By leveraging macOS’s Launch Services, to run an open -stdin command on a specially crafted Python file with this prefix, the attacker can bypass the sandbox, Microsoft further explained.

This method also allows threat actors to bypass “built-in, baseline security features” in macOS, compromising both system and user data as a result.

Microsoft published a proof-of-concept, whose code is so simple that one can simply drop a Python file, with the abovementioned prefix, with arbitrary commands.

“Python happily runs our code, and since it’s a child process of launchd, it isn’t bound to Word’s sandbox rules,” Microsoft said.

Via: BleepingComputer (opens in new tab)

Source