This blog post shares the details of a vulnerability Offensive Security discovered in the XPC service of Microsoft Teams. Although Microsoft secured these services reasonably well, we will see how small code mistakes can have serious impacts.<\/p>\n
We reported the issue to MSRC, but unfortunately Microsoft decided that \u201cthe finding is valid but does not meet our bar for immediate servicing.\u201d While they have since hardened the XPC service, it remains exploitable.<\/p>"},{"title":"CVE-2020-0984 - Secure coding XPC Services - Part 3 - Incorrect client verification","link":"https:\/\/theevilbit.github.io\/posts\/secure_coding_xpc_part3\/","pubDate":"Fri, 29 May 2020 00:00:00 +0000","guid":"https:\/\/theevilbit.github.io\/posts\/secure_coding_xpc_part3\/","description":"
This is the third post in my series which is trying to help Apple developers to avoid typical insecure coding practices. This one will highlight why XPC client hardening and proper verification is extremely important when we use XPC messaging on macOS between clients that run as a normal user and services that run as root. If this validation is not right, it opens up the possibility for an attacker to run privileged commands or worse case, achieve full privilege escalation on the system.<\/p>"}]}}