PT-2022-17244 · Unknown · Cryptomator

Published 2022-02-19 · Updated 2023-08-08 · CVE-2022-25366

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cryptomator versions 1.6.5 and earlier

Description The issue allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements. An attacker can exploit this by creating a malicious .dylib file that can be executed via the DYLD INSERT LIBRARIES environment variable.

Recommendations For Cryptomator versions 1.6.5 and earlier, consider disabling the use of the DYLD INSERT LIBRARIES environment variable to minimize the risk of exploitation until a patch is available. Restrict access to the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements to prevent malicious .dylib files from being executed. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2022-25366

Affected Products

Cryptomator

References · 6

• 🔥 https://medium.com/@tehwinsam/cryptomator-1-6-5-dylib-injection-8004a1e90b26 · Exploit
• https://cryptomator.org · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25366 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25366 · Security Note
• https://t.me/cibsecurity/37817 · Telegram Post
• https://medium.com/%40tehwinsam/cryptomator-1-6-5-dylib-injection-8004a1e90b26 · Note