CVE-2024-27876

MEDIUM

macOS Ventura <13.7 - Code Injection

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-27876. PoCs published by 0xilis.

AI-analyzed exploit summary This repository contains a PoC exploit for CVE-2024-27876, targeting a vulnerability in libAppleArchive. The exploit creates a malicious archive with symlinks and files designed to bypass Gatekeeper by leveraging a race condition in the archive extraction process.

Description

A race condition was addressed with improved locking. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7, visionOS 2. Unpacking a maliciously crafted archive may allow an attacker to write arbitrary files.

Exploits (1)

nomisec WORKING POC 48 stars

by 0xilis · poc

https://github.com/0xilis/CVE-2024-27876

View Code ZIP pw:eip

This repository contains a PoC exploit for CVE-2024-27876, targeting a vulnerability in libAppleArchive. The exploit creates a malicious archive with symlinks and files designed to bypass Gatekeeper by leveraging a race condition in the archive extraction process.

Classification

Working Poc 95%

Attack Type

Auth Bypass

Complexity

Moderate

Reliability

Racy

Target: libAppleArchive (macOS)

No auth needed

Prerequisites: Access to a vulnerable macOS system · Ability to deliver a malicious archive file

MITRE ATT&CK