Last year, I discovered a full user TCC bypass issue in the macOS Sonoma beta version. There was a CVE number assigned at the beginning, but removed by Apple in the release of macOS 14.0. Instead, I got the credit in their Additional Recognitions.

According to the Apple Security Bounty program, this report should have been rewarded with an additional 50%. Unfortunately, the truth is that I was cut off 50%.

The Vulnerability

The vulnerability existed in the XPC service /System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc.

Since the release of macOS Sonoma beta, the XPC service has got the FDA (Full Disk Access) entitlement:

	[Key] com.apple.private.tcc.allow
	[Value]
		[Array]
			[String] kTCCServiceSystemPolicyAllFiles

It accepts all the XPC clients by returning YES in the delegate method:

It provides 9 service routines for the XPC client in the protocol AUHelperServiceProtocol:

@protocol AUHelperServiceProtocol
-(void) validateTargetDirectory:(NSURL *)target archiveWrapper:(NSSecurityScopedURLWrapper *)wrapper withReply:(void (^)(NSSecurityScopedURLWrapper *))reply;
-(void) moveWithUniquingFrom:(NSURL *)from into:(NSURL *)into baseName:(NSString *)baseName sourceWrapper:(NSSecurityScopedURLWrapper *)wrapper withReply:(void (^)(NSSecurityScopedURLWrapper *))reply;
...
@end

Therefore, there are some different ways to exploit this issue by requesting the different service routines.

Exploit 1

My first exploit was to request the method validateTargetDirectory:archiveWrapper:withReply:

It can be exploited to get the read & write permission of an arbitrary path, even it is TCC-protected!

However, this exploit has a limitation: the sandbox extension can’t be issued to the user’s TCC.db directly.

In order to replace the user’s TCC.db file, I developed the following exploit 2.

Exploit 2

The second exploit is to abuse the routine moveWithUniquingFrom:into:baseName:sourceWrapper:withReply:

It gives me a primitive to move/replace the TCC.db file because of its FDA permission.

The exploit is public here for research purpose only.

Patch in macOS 14.0

Apple patched the issue immediately before releasing the macOS Sonoma.

Now, the XPC client must have the entitlement com.apple.private.AUHelperService.XPC:

Timeline