Process Injection: Breaking All macOS Security Layers With a Single Vulnerability

Overview: Thijs Alkemade of Computest details the discovery and exploitation of CVE-2021-30873, a critical process injection vulnerability within Apple's AppKit framework. The presentation explains how macOS security boundaries have evolved from traditional Unix user privileges to process-centric isolation enforced by System Integrity Protection (SIP), entitlements, and Data Vaults. Alkemade demonstrates how exploiting AppKit's saved state restoration mechanism enables sandbox escape, privilege escalation, and full SIP bypass.

Key Topics: - Evolution of macOS security architecture: System Integrity Protection (SIP) and entitlements - Data Vault protections, Hardened Runtime, and process isolation boundaries - AppKit Persistent UI architecture (windows.plist and data.data saved state files) - CVE-2021-30873: Deserialization flaw in saved state handling enabling arbitrary code injection

Technical Details: Mac OS X historically adhered to the Unix security model where user IDs established security boundaries and root possessed absolute system access. Beginning with OS X 10.11 El Capitan (2015), Apple introduced System Integrity Protection (SIP / "rootless"), establishing processes as security boundaries. Under SIP, root permissions are insufficient to modify system files, attach debuggers to protected processes, or load arbitrary kernel extensions; instead, sensitive operations require cryptographic code signatures containing Apple-authorized entitlements. Furthermore, SIP enforces Data Vaults—restricted directory structures protected by entitlements like com.apple.rootless.storage.mail that prevent even root processes from reading user emails, messages, or Safari history.

To defend these process boundaries, macOS implements the Hardened Runtime and Library Validation, preventing traditional injection techniques such as DYLD_INSERT_LIBRARIES hijacking. However, legacy frameworks written prior to SIP introduce severe vulnerabilities. Alkemade identified CVE-2021-30873 within AppKit's Persistent UI (saved state) subsystem, which automatically restores open windows and unsaved documents upon application relaunch or system reboot. Application state is saved to ~/Library/Saved Application State/<bundle-id>.savedState/, consisting of a windows.plist file containing window metadata and encryption keys, and a data.data file containing serialized object state.

Because AppKit automatically deserialized data from data.data using insecure decoding mechanisms without verifying class types or caller privileges, an unprivileged local process could write malicious serialized payloads into an application's saved state folder. When the victim application launched, AppKit instantiated arbitrary classes and hijacked the process execution flow. Because this vulnerability resided universally within AppKit, an attacker could target sandboxed applications to escape sandboxes, target administrative applications to achieve root execution, and inject into entitled system utilities possessing Data Vault and SIP-exempt capabilities to completely circumvent macOS platform integrity protections.

Key Takeaways: Enforcing process boundaries requires securing all inter-process persistence and state-sharing mechanisms, not merely dynamic linking and debugging interfaces. Developers must implement Apple's applicationSupportsSecureRestorableState delegate method in modern Xcode templates to enforce secure coding during state restoration. Security researchers and defensive engineers must audit state serialization files in ~/Library/Saved Application State/ as unvalidated attack surfaces capable of subverting Hardened Runtime and SIP protections.

(AI summary — Gemini Flash)