Unveiling the Apple CVE-2024-40834 - A 'shortcut' to the Bypass Road

The talk grew out of a red team engagement that needed an initial payload for macOS without relying on a zero-day. Shortcuts looked promising because users already trust it. The speaker, a penetration tester at a small Australian firm, explains how the app chains actions into automations that Apple signs and lets people share. Script execution is blocked by default and must be enabled manually, but file operations such as write, append, move and rename need no special approval.

By writing a shell startup file in the home directory and then opening Terminal, the speaker showed that code runs without warnings. An early attempt failed because appending only worked on files that already existed. The working version saved a payload, renamed it to a dotfile with the extension stripped so the file was created, and then shared the shortcut. Apple signed it, and a calculator pop-up served as the demo. The signed or unsigned file could be sent by email, and the speaker reported that mail services and antivirus tools did not flag it at the time. Apple's fix added a prompt on move and rename, but appending to existing files remained exploitable. The talk also described file read through URL handlers and several other Shortcuts issues.

The main takeaway is that a trusted, vendor-signed automation tool can serve as a phishing delivery and execution path. Defenders should treat such apps as part of their attack surface, and researchers are encouraged to probe handler protocols and file primitives in similar tools.