{"uuid": "4bc79a35-777b-408d-8516-65f498599482", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30853", "type": "seen", "source": "https://t.me/hacking_Attack/36218", "content": "Black Hat Ethical Hacking\nApple fixes macOS security flaw behind Gatekeeper bypass\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Apple fixes macOS security flaw behind Gatekeeper bypassPost Views: 105 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nApple has addressed a macOS vulnerability that unsigned and unnotarized script-based apps could exploit to bypass all macOS security protection mechanisms even on fully patched systems.\nIf they circumvent automated notarization security checks\u00a0(which scans for malicious components and code-signing issues), the applications are allowed to launch by Gatekeeper, a macOS security feature designed to verify if downloaded apps are notarized and developer-signed.\n\nOnce malicious script-based apps targeting the bypass flaw (CVE-2021-30853) are launched on a target\u2019s system, they can be used by attackers to download and deploy second-stage malicious payloads.\n\nApple has addressed this vulnerability in macOS 11.6\u00a0through a security update released in September 2021 that adds improved checks.\nSee Also: Complete Offensive Security and Ethical Hacking Course Gatekeeper bypass with a shebangThe CVE-2021-30853 Gatekeeper bypass bug was discovered and reported to Apple by Box Offensive Security Engineer Gordon Long.\n\nHe found that specially-crafted script-based applications downloaded from the Internet would launch without showing an alert even though automatically quarantined.\n\nThe \u201cspecially-crafted\u201d part requires creating an app that uses a script starting with a shebang (!#) character but leaving the rest of the line empty, which tells the Unix shell to run the script without specifying a shell command interpreter.\n\nThis leads to a Gatekeeper bypass because the syspolicyd daemon automatically commonly invoked by the AppleSystemPolicy kernel extension to perform security checks (signing and notarization) no longer gets triggered for inspection when launching a script without specifying an interpreter.\n\nBasically, if the script used a shebang (!#) but did not explicitly specify an interpreter, it would bypass Gatekeeper security checks.\nIn short, unsigned, non-notarized script-based applications would be allowed if their script did *not* specify an interpreter! \ud83e\udd2f\ud83e\udd23\n\nMeaning attackers could trivially bypass a myriad of foundational macOS security mechanisms via:\n#!\n<anypic.twitter.com/WPSABkXR7i\n\n \n\u2014 Objective-See (@objective_see) December 22, 2021\nSee Also: Hackers start pushing malware in worldwide Log4Shell attacks \u201cThe syspolicyd daemon will perform various policy checks and ultimately prevent the execution of untrusted applications, such as those that are unsigned or unnotarized,\u201d explained\u00a0security researcher Patrick Wardle.\n\n\u201cBut, what if the AppleSystemPolicy kext decides that the syspolicyd daemon does not need to be invoked? Well then, the process is allowed! And if this decision is made incorrectly, well then, you have a lovely File Quarantine, Gatekeeper, and notarization bypass.\u201d\nAs revealed by Wardle, threat actors can exploit this flaw by tricking their targets into opening a malicious app that can also be camouflaged as a benign-looking PDF document.\n\nSuch malicious payloads can be delivered on targets\u2019 systems via many methods, including poisoned search results, fake updates, and trojaned applications downloaded from sites linking to pirated software.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/macOS_infection_vectors.png \n<figcaptionImage: Patrick Wardle \nSee Also: Offensive Security Tool: log4j-scan Similar bugs exploited by malwareThis [...]", "creation_timestamp": "2026-09-02T01:02:27.326665Z"}