CVE-2021-30782

Vulnerability

A logic issue in macOS allowed a malicious application to bypass file access restrictions and read files that should be protected. The vulnerability affects macOS Big Sur before version 11.5, macOS Catalina before Security Update 2021-004, and macOS Mojave before Security Update 2021-005. Apple addressed the issue with improved checks in the respective updates [1][2][3].

Exploitation

An attacker must have the ability to run a malicious application on the target system. No additional privileges or user interaction beyond launching the app are required. The application exploits the insufficient checks to access restricted files, potentially reading sensitive data.

Impact

Successful exploitation allows the malicious application to read restricted files, leading to unauthorized disclosure of sensitive information. The attacker gains access to files that are normally protected from user-level applications, compromising confidentiality.

Mitigation

Apple released fixes on July 21, 2021: macOS Big Sur 11.5, Security Update 2021-004 for Catalina, and Security Update 2021-005 for Mojave [1][2][3]. Users should update to these versions. No workarounds are documented.