{"uuid": "49b5f244-6e40-49e6-b679-3f4bb6f3be05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30713", "type": "seen", "source": "https://t.me/hacking_Attack/38195", "content": "Black Hat Ethical Hacking\nMicrosoft: powerdir bug gives access to protected macOS user data\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft: powerdir bug gives access to protected macOS user dataPost Views: 71 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nThe Microsoft 365 Defender Research Team has reported the vulnerability dubbed\u00a0powerdir\u00a0(tracked as CVE-2021-30970) to Apple on July 15, 2021, via the Microsoft Security Vulnerability Research (MSVR).\nMicrosoft says threat actors could use a macOS vulnerability to bypass Transparency, Consent, and Control (TCC) technology to access users\u2019 protected data.\n\nWhile Apple has restricted TCC access only to apps with full disk access and set up features to automatically block unauthorized code execution, Microsoft security researchers found that attackers could plant a second, specially crafted TCC database that would allow them to access protected user info.\n\n\u201cWe discovered that it is possible to programmatically change a target user\u2019s home directory and plant a fake TCC database, which stores the consent history of app requests,\u201d said\u00a0Jonathan Bar Or, a principal security researcher at Microsoft.\n\n\u201cIf exploited on unpatched systems, this vulnerability could allow a malicious actor to potentially orchestrate an attack based on the user\u2019s protected personal data.\nSee Also: Complete Offensive Security and Ethical Hacking Course\n\u201cFor example, the attacker could hijack an app installed on the device\u2014or install their own malicious app\u2014and access the microphone to record private conversations or capture screenshots of sensitive information displayed on the user\u2019s screen.\u201d\n\nApple has also patched other TCC bypasses reported since 2020, including:\n\n* Time Machine mounts\u00a0(CVE-2020-9771): macOS offers a built-in backup and restore solution called Time Machine. It was discovered that Time Machine backups could be mounted (using the apfs_mount utility) with the \u201cnoowners\u201d flag. Since these backups contain the TCC.db files, an attacker could mount those backups and determine the device\u2019s TCC policy without having full disk access.\n* Environment variable poisoning\u00a0(CVE-2020-9934): It was discovered that the user\u2019s tccd could build the path to the TCC.db file by expanding $HOME/Library/Application Support/com.apple.TCC/TCC.db. Since the user could manipulate the $HOME environment variable (as introduced to tccd by launchd), an attacker could plant a chosen TCC.db file in an arbitrary path, poison the $HOME environment variable, and make TCC.db consume that file instead.\n* Bundle conclusion issue\u00a0(CVE-2021-30713): First disclosed by Jamf\u00a0in a blog post about the XCSSET malware family, this bug abused how macOS was deducing app bundle information. For example, suppose an attacker knows of a specific app that commonly has microphone access. In that case, they could plant their application code in the target app\u2019s bundle and \u201cinherit\u201d its TCC capabilities.\nhttps://www.bleepstatic.com/images/news/u/1109292/2022/powerdir_poc.png \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:22.239679Z"}