1769683 - Wrong config options cause tcc bypass - Firefox mac

Status: RESOLVED DUPLICATE of bug 1562756

(Core :: Widget: Cocoa, defect)

Description

[vlinkstone]

Attachment: poc.zip

explanation

Due to unsafe configuration, attack could use firefox for TCC-Bypass.
Firefox version: mac, Mozilla Firefox 100.0.1

codesign -dv --entitlements - /Applications/Firefox.app
Executable=/Applications/Firefox.app/Contents/MacOS/firefox
Identifier=org.mozilla.firefox
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=479 flags=0x10000(runtime) hashes=6+5 location=embedded
Signature size=8988
Timestamp=May 14, 2022 at 05:14:16
Info.plist entries=25
TeamIdentifier=43AQ936H96
Runtime Version=10.12.0
Sealed Resources version=2 rules=13 files=82
Internal requirements count=1 size=188
[Dict]
	[Key] com.apple.security.cs.allow-dyld-environment-variables
	[Value]
		[Bool] true
	...
	[Key] com.apple.security.cs.disable-library-validation
	[Value]
		[Bool] true
	[Key] com.apple.security.device.audio-input
	[Value]
		[Bool] true
	[Key] com.apple.security.device.camera
	[Value]
		[Bool] true
	[Key] com.apple.security.get-task-allow
	...

although the codesign flags contains runtime, but the entitlements contains both com.apple.security.cs.allow-dyld-environment-variables and com.apple.security.cs.disable-library-validation, so that the firefox could be injected via DYLD_INSERT_LIBRARIES

At the same time, firefox has applied for the permissions of the microphone and camera.
Once the user grants these two permissions to firefox, the attacker can also obtain the corresponding permissions through injection.

Demo

poc.zip
use this demo code , we can inject firefox via DYLD_INSERT_LIBRARIES and use firefox permissions to record.

Fix

1. add codesign flags with library-validation
2. delete these two etitlements, com.apple.security.cs.allow-dyld-environment-variables and com.apple.security.cs.disable-library-validation.

Comment 1

[:Gijs (back August 25; he/him)]

Dupe of bug 1562756, I think - Haik, can you confirm?

Comment 2

[Haik Aftandilian [:haik]]

Yes, I agree this is a dupe of bug 1562756.

@vlinkstone, thanks for the report. We have bug 1562756, where we have been tracking removing the com.apple.security.cs.allow-dyld-environment-variables entitlement which is something we want to get done, but had blockers in the past. The tcc bypass is a legitimate concern and I had not considered that as a motivation for fixing 1562756 so I'm glad you raised the issue. To restate, if an attacker already has code execution on the host, and the user has already allowed Firefox to access the camera and or mic, the attacker could inject a dylib into Firefox which could turn on the camera/mic.