PT-2024-36362 · Apple · Apple Macos

Published 2024-12-11 · Updated 2025-03-12 · CVE-2024-54498

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

The software that is vulnerable is macOS, specifically the versions prior to macOS Sequoia 15.2, macOS Ventura 13.7.2, and macOS Sonoma 14.7.2. The vulnerability is a path handling issue that was addressed with improved validation, allowing an app to potentially break out of its sandbox. A proof-of-concept (PoC) exploit has been released, which demonstrates the vulnerability and allows apps to bypass sandbox protections, posing a high risk of data theft. The vulnerability has been patched in the latest versions of macOS, and users are advised to update their systems to prevent exploitation. There is a public exploit available for this vulnerability, and it is possible that attackers may exploit it to gain unauthorized access to sensitive data. The vulnerability is identified as CVE-2024-54498, and it affects the sharedfilelistd component of macOS. The exploit can be used to escape the macOS sandbox, allowing malicious apps to access sensitive data and compromise the system. #macOS #CVE202454498 #CybersecurityNews #SandboxVulnerability #DataTheft #PatchNow #macOSVulnerability #CVE2024 #Cybersecurity

Exploit

Fix

Related Identifiers

CVE-2024-54498

Affected Products

Apple Macos

References · 38

• 🔥 https://github.com/wh1te4ever/CVE-2024-54498-PoC · Exploit
• https://support.apple.com/en-us/121840 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-54498 · Vendor Advisory
• https://support.apple.com/en-us/121839 · Vendor Advisory
• https://support.apple.com/en-us/121842 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-54498 · Security Note
• https://twitter.com/UN5T48L3/status/1878965577638973841 · Twitter Post
• https://twitter.com/Dinosn/status/1878685002529165366 · Twitter Post
• https://twitter.com/fletch_ai/status/1879061091474641259 · Twitter Post
• https://twitter.com/ksg93rd/status/1878859077591478728 · Twitter Post
• https://twitter.com/piedpiper1616/status/1878944171245121576 · Twitter Post
• https://twitter.com/EncryptionEdge7/status/1879551542795407785 · Twitter Post
• https://reddit.com/r/k12cybersecurity/comments/1hcx6t8/msisac_cybersecurity_advisory_multiple · Reddit Post
• https://twitter.com/iDownloadBlog/status/1877168308140597368 · Twitter Post
• https://twitter.com/binitamshah/status/1878803164553765195 · Twitter Post