A security bod scored a $100,500 bug bounty from Apple after discovering a vulnerability in Safari on macOS that could have been exploited by a malicious website to potentially access victims’ logged-in online accounts – and even their webcams.
Ryan Pickren, last seen on The Register after scooping $75k from Cupertino’s coffers for finding an earlier webcam-snooping flaw, said the universal cross-site scripting (UXSS) bug in Safari could have been abused by a webpage to hijack a web account the user is logged into, which would be bad. It was also possible to activate the webcam.
Pickren told El Reg the flaw granted “full access to every website you’ve visited in Safari, meaning that if you’re visiting my evil website on one tab, and then your other tab, you have Twitter open, I can jump into that tab and do everything you can from that screen. So it does allow me to fully perform an account takeover on every website you visited in Safari.”
This attack is a bit of a wild ride, so strap in, and suffice to say: Apple has now patched the underlying vulnerability.
It involves webarchive files, which Safari generates when saving a copy of a webpage, and custom URI schemes that launch apps – think irc:, mailto:, chrome:, s3: and so on. There’s a list of them compiled by the Internet Assigned Numbers Authority.
Non-standard URI schemes, when opened in Safari, trigger a warning dialog box before loading an external app to handle the request, Pickren said. That said, there’s a list of trusted schemes hardcoded in Safari that open automatically without a prompt when requested. One of these schemes is icloud-sharing:, which fires up the operating system’s internal ShareBear app to share a document via iCloud. A webpage that requests an icloud-sharing: link in Safari causes ShareBear to fire up to fetch the remote content.
“ShareBear was interesting to me because sharing iCloud documents seemed like a plausible path towards downloading and launching webarchive files,” continued Pickren in a write-up on his website about the vulnerability.
When ShareBear goes to fetch the requested content, and it’s the first time it’s done so for this file, it asks the user to accept the file. If the user accepts and downloads the document, whoever created the shared document can later change the content of the file on their Mac, and ShareBear will automatically change the file on the victim’s machine.
So a webpage could offer an innocent-looking PNG, which the victim accepts and saves to disk. The owner of the file could then change it to a webarchive file, including the type, which is sync’d to the victim’s machine, and launch it via a webpage visited by the victim. Pickren summarized this critical problem thus:
Pickren focused on opening a webarchive file on the victim’s machine because macOS’s Gatekeeper strives to block unapproved apps from running and downloaded webarchive files from opening – and it seemed easier to bypass the webarchive restriction. Doing just that was as simple as using a .url file, along with a .dmg file trick to ensure the malicious webarchive is stored in a known location – the /Volume folder.
Finally, when the malicious webarchive is launched by the attacker’s webpage, it can run JavaScript in an arbitrary attacker-chosen origin, such as twitter.com or google.com, and this code can do whatever the user can do in that context. This means the webcam can be switched on in a trusted video chat context, such as facetime.apple.com.
Apple addressed these bugs in two parts, Pickren said. One, macOS Monterey 12.0.1 was released with ShareBear updated to just reveal downloaded files rather than launching them; and two, patching a bug designated CVE-2021-30861 in Safari’s engine WebKit to stop quarantined files – such as downloaded webarchives – from being opened.
For finding and reporting this security hole in mid-2021, and related vulnerabilities, Pickren was awarded a $100,500 (£74,000) bounty, he said.
If someone at Apple would like to comment, you know where to find us. ®