Have U Been Invited (episode 2) - MacOS Logic Bugs

This talk is a follow-up to last year's presentation on a macOS Calendar vulnerability. The earlier flaw allowed an arbitrary file write through attachment file names in calendar events. Fixes were still pending at the time, so the full chain could not be shown then. This episode picks up from that point and walks through the chain step by step, starting from a write that is confined to the Calendar app's sandbox.

The middle of the talk covers each obstacle in turn. The write is used to plant a local calendar, which can carry alert actions, and a legacy migration marker that forces the app to index it. A disk image is then planted so that Finder mounts a remote share and indexes an application inside it, which avoids the quarantine flag that Gatekeeper checks. A newly registered URL handler launches that application, which runs code and changes the Photos library configuration. Photos then syncs the user's iCloud library into a directory the attacker controls, so the protected original folder is never accessed directly.

The closing section reviews the disclosure timeline, which ran from late 2022 into late 2023 with several rounds of back-and-forth with Apple over CVE assignment and credit. The practical takeaway is that small logic errors in file handling, combined with hidden app features and configuration, can get around several macOS protections at once.