Process injection: breaking all macOS Sec Layers with a Single Vulnerability

The talk covers CVE-2021-30873, a process injection flaw in macOS that affected applications built on AppKit. The researchers, from Computest, start by contrasting the traditional Unix user-based model of macOS with the newer layers added since System Integrity Protection: entitlements, protected data locations and per-application boundaries between processes running as the same user. They then describe the saved application state feature, which stores window and document data in a custom file whose serialized objects were encrypted with a key stored right beside them and had no integrity check.

The middle of the talk follows the exploit chain. The team found that the older, non-secure decoding path let them create arbitrary Objective-C objects and invoke methods during deserialization. They used those primitives to run AppleScript inside the target process, then to load Python through a scripting bridge that ships with macOS. Python's C types module, with the function-pointer features removed, gave native code execution despite the hardened runtime and library validation. From there they showed a sandbox escape through the open and save panel service, privilege escalation to root via an Apple-signed installer entitlement, and a SIP bypass by altering the kernel extension approval database. A live demo ended with a root shell and a write to a protected directory.

The closing takeaways are that adding security layers to a long-lived codebase is hard, because old code still assumes the previous trust model, and that one bug can defeat several layers at once. Apple's complete fix shipped in Monterey and makes secure coding the default for new applications, but third-party developers must still update their own apps to close the issue.