CVE-2023-32422
MEDIUMiPadOS < 16.5 - Privacy Preference Bypass via SQLite Logging
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2023-32422. PoCs published by gergelykalman.
AI-analyzed exploit summary This PoC demonstrates a TCC (Transparency, Consent, and Control) bypass in macOS via SQLite manipulation, allowing unauthorized access to protected services by injecting malicious SQLite queries into the TCC database. The exploit leverages a vulnerability in how macOS handles SQLite database operations to bypass privacy protections.
Description
This issue was addressed by adding additional SQLite logging restrictions. This issue is fixed in iOS 16.5 and iPadOS 16.5, tvOS 16.5, macOS Ventura 13.4. An app may be able to bypass Privacy preferences.
Exploits (1)
This PoC demonstrates a TCC (Transparency, Consent, and Control) bypass in macOS via SQLite manipulation, allowing unauthorized access to protected services by injecting malicious SQLite queries into the TCC database. The exploit leverages a vulnerability in how macOS handles SQLite database operations to bypass privacy protections.
References (6)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N