{"uuid": "3a94d9c8-7217-4438-8de9-7702457c77f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "seen", "source": "https://t.me/hacking_Attack/61398", "content": "Black Hat Ethical Hacking\nMicrosoft releases tweet-size exploit for macOS sandbox escape bug\n\nMicrosoft releases tweet-size exploit for macOS sandbox escape bugPost Views: 22 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nMicrosoft has published the exploit code for a vulnerability in macOS\u00a0that\u00a0could help an attacker bypass sandbox restrictions and run code on the system.\n\nThe company released the technical details for the security issue, which is currently identified as CVE-2022-26706, and explained how\u00a0the macOS App Sandbox rules could be avoided to allow malicious macro code in Word documents to execute commands on the machine.\n\nAbusing macros in Office documents to deploy malware has long been an efficient and popular technique to compromise Windows systems.\n\nThe same could be achieved on macOS machines lacking the proper security updates, Microsoft warns in a report today.\n\u201cDespite the security restrictions imposed by the App Sandbox\u2019s rules on applications, it\u2019s possible for attackers to bypass the said rules and let malicious codes \u201cescape\u201d the sandbox and execute arbitrary commands on an affected device\u201d \u2013 Microsoft\nJonathan Bar Or of the Microsoft 365 Defender Research Team explains that the vulnerability was discovered while looking into methods to run and detect malicious macros in Microsoft Office documents on macOS.\n\nTo ensure backward compatibility, Microsoft Word can read and write files that come with the prefix \u201c~$,\u201d which is defined in the app\u2019s sandbox rules. \nhttps://www.bleepstatic.com/images/news/u/1100723/2022/MSWord-sandbox-rule.png \nExploit code in a tweetAfter studying older reports [1, 2] about escaping the macOS sandbox, the researchers found that using Launch Services to run an open \u2013stdin\u00a0command on a special Python file with the abovementioned prefix allows escaping the App Sandbox on macOS, potentially leading to compromising the system.\n\nThe researchers came up with a proof-of-concept (PoC) that used the -stdin\u00a0option for the open\u00a0Command on a Python file to bypass the \u201ccom.apple.quarantine\u201d\u00a0extended attribute restriction.\n\nThe demo exploit code is as simple as dropping a Python file that contains arbitrary commands and has in its name the special prefix for Word.\n\nUsing the open -stdin\u00a0command starts the Python app with the specially crafted file as the standard input.\n\n\u201cPython happily runs our code, and since it\u2019s a child process of launchd, it isn\u2019t bound to Word\u2019s sandbox rules,\u201d Jonathan Or Bar explains.\nhttps://www.bleepstatic.com/images/news/u/1100723/2022/macOS_SBX_Microsoft.png \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:34.701962Z"}