Security News > 2021 > September > New macOS zero-day bug lets attackers run commands remotely
Security researchers disclosed today a new vulnerability in Apple's macOS Finder, which makes it possible for attackers to run arbitrary commands on Macs running any macOS version up to the latest release, Big Sur.
The bug, found by independent security researcher Park Minchan, is due to the way macOS processes inetloc files which inadvertently causes it to run any commands embedded by an attacker inside without any warnings or prompts.
"A vulnerability in macOS Finder allows files whose extension is inetloc to execute arbitrary commands," SSD Secure Disclosure advisory published today revealed.
"These files can be embedded inside emails which if the user clicks on them will execute the commands embedded inside them without providing a prompt or warning to the user."
Although the researcher did not provide any info on how this bug might be abused by attackers, it could potentially be used by threat actors to create malicious email attachments that, when opened by the target, would be able to launch a bundled or remote payload. BleepingComputer also tested the proof-of-concept exploit shared by the researcher and was able to confirm that the vulnerability can be used to run arbitrary commands on macOS Big Sur using specially crafted files downloaded from the Internet without any prompts or warnings.
An.inetloc file with the PoC code was not detected by any of the antimalware engines on VirusTotal which means that macOS users potentially targeted by threat actors using this attack method won't be protected by security software.