A recent security assessment by Cisco Talos has unveiled eight critical vulnerabilities affecting Microsoft software on macOS, raising alarms about possible misuse by malicious actors.
These flaws, if leveraged, could enable attackers to override the permissions and privileges assigned to Microsoft apps, potentially granting unauthorized access to sensitive features like microphones, cameras, and personal information. The issues are linked to the macOS security framework, specifically the Transparency, Consent, and Control (TCC) system.
The TCC framework is designed to safeguard user privacy by ensuring that apps obtain explicit permission before accessing sensitive data. However, Cisco Talos has identified that certain Microsoft applications can be exploited to bypass these safeguards, allowing attackers to utilize app permissions without user consent.
Affected Software
The vulnerabilities affect several Microsoft products, each associated with a specific CVE (Common Vulnerability and Exposure) identifier:
- Microsoft Outlook (CVE-2024-42220)
- Microsoft Teams (for work or school) (CVE-2024-42004)
- Microsoft PowerPoint (CVE-2024-39804)
- Microsoft OneNote (CVE-2024-41159)
- Microsoft Excel (CVE-2024-43106)
- Microsoft Word (CVE-2024-41165)
- Microsoft Teams WebView.app helper (CVE-2024-41145)
- Microsoft Teams com.microsoft.teams2.modulehost.app (CVE-2024-41138)
Exploitation of these vulnerabilities could allow attackers to perform unauthorized actions such as sending emails, recording audio, or capturing video without the user’s knowledge. Despite the gravity of these vulnerabilities, Microsoft has deemed them as low risk and opted not to address them, citing the necessity to support unsigned libraries for plugin compatibility in certain apps.
The vulnerabilities are categorized into two main groups: Microsoft Office applications (Word, Outlook, Excel, OneNote, PowerPoint) and Microsoft Teams apps (Teams, WebView.app, com.microsoft.teams2.modulehost.app). These apps are susceptible to library injection attacks because they possess the com.apple.security.cs.disable-library-validation entitlement, which permits the injection and execution of arbitrary code within the affected applications.
For instance, a compromised Microsoft Outlook could be used to send emails without user intervention, while a manipulated Microsoft Teams could access the camera and microphone without any alert to the user.
Insights into macOS Security
macOS employs a multi-layered security architecture featuring TCC and entitlements to ensure user privacy. TCC mandates user approval for accessing sensitive information, while entitlements define the capabilities of applications. Nevertheless, these vulnerabilities expose potential flaws in this security model, especially when trusted apps are compromised.
Microsoft has released updates for four of the affected apps, eliminating the entitlement that permitted library validation to be disabled. However, Microsoft Excel, Outlook, PowerPoint, and Word continue to be vulnerable. Users are advised to remain vigilant, regularly check application permissions through macOS’s “Privacy & Security” settings, and keep their software up-to-date.
The identification of these vulnerabilities highlights the necessity for robust security practices in software development. While macOS’s security framework offers substantial protection, the possibility of exploitation through trusted apps underscores the need for ongoing security enhancements and vigilance.
