Apple · macOS
Apple macOS contains a logic flaw in its state management that allows a malicious application to bypass Gatekeeper checks, fixed in macOS Big Sur 11.3 and Security Update 2021-002 Catalina. An attacker needs a local presence on the system and must get a user to run the malicious application, with no authentication required.
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekeeper checks. Apple is aware of a report that this issue may have been actively exploited..
First seen exploited 4 months before it was disclosed. Public exploit code (Metasploit) was available 5 months before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
user runs malicious application to trigger bypass
A malicious application may bypass Gatekeeper checks
bypasses Gatekeeper code-signing/quarantine protections
A malicious application may bypass Gatekeeper checks
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2021-30657 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Due to the file path layout in which this script is set up, double-clicking the install icon executes the script held within 1302.app and bypasses the checks performed by Gatekeeper, described in further detail in CVE-2021-30657.
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.