PT-2021-22925 · Sketch+1 · Sketch+1

Jon Palmisciano · Published 2021-09-06 · Updated 2022-04-25 · CVE-2021-40531

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sketch versions prior to 75

Description The issue allows library feeds to be used to bypass file quarantine, resulting in remote code execution. This can be achieved by using a CommandString in a terminal profile to Terminal.app, allowing files to be automatically downloaded and opened without the com.apple.quarantine extended attribute.

Recommendations For Sketch versions prior to 75, update to version 75 or later to resolve the issue. As a temporary workaround, consider disabling the use of external library feeds until a patch is available. Restrict access to terminal profiles and avoid using CommandString to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-40531

Affected Products

Sketch

Terminal.App

References · 9

• 🔥 https://github.com/jonpalmisc/CVE-2021-40531 · Exploit
• 🔥 https://jonpalmisc.com/2021/11/22/cve-2021-40531 · Exploit
• https://sketch.com/updates/#version-75 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40531 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40531 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/4830 · Telegram Post
• https://t.me/cibsecurity/28305 · Telegram Post
• https://t.me/pentestingnews/14667 · Telegram Post
• https://t.me/cvenotify/23805 · Telegram Post