Talos Vulnerability Report

SUMMARY

A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams’s access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application’s permissions.

CONFIRMED VULNERABLE VERSIONS

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

Microsoft Teams (work or school) 24046.2812.2722.8193 for macOS

PRODUCT URLS

Teams (work or school) - https://www.microsoft.com/en/microsoft-teams

CVSSv3 SCORE

7.1 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-347 - Improper Verification of Cryptographic Signature

DETAILS

Microsoft Teams is a comprehensive collaboration platform within the Microsoft 365 suite, designed to facilitate workplace communication, video conferencing, file sharing, and integration with other Office applications.

Microsoft Teams (work or school)’s com.microsoft.teams2.modulehost.app helper app, from now modulehost, loads multiple libraries through relative path:

$ otool -L "/Applications/Microsoft Teams (work or school).app/Contents/Helpers/com.microsoft.teams2.modulehost.app/Contents/MacOS/com.microsoft.teams2.modulehost":
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.30.104)
[...]
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1336.61.1)
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit (compatibility version 1.0.0, current version 275.0.0)
@rpath/libSlimCoreWebview2.dylib (compatibility version 0.0.0, current version 0.0.0)
@rpath/MacRenderer.framework/Versions/A/MacRenderer (compatibility version 0.0.0, current version 0.0.0)
@rpath/MSWebView2.framework/MSWebView2 (compatibility version 0.0.0, current version 0.0.0)
[...]
/System/Library/Frameworks/UniformTypeIdentifiers.framework/Versions/A/UniformTypeIdentifiers (compatibility version 1.0.0, current version 709.0.0)
[...]
/System/Library/Frameworks/UniformTypeIdentifiers.framework/Versions/A/UniformTypeIdentifiers (compatibility version 1.0.0, current version 709.0.0)

In this case the location is relative to the main executable /Applications/Microsoft Teams (work or school).app/Contents/Helpers/com.microsoft.teams2.modulehost.app/Contents/MacOS/com.microsoft.teams2.modulehost. The modulehost app has the following entitlements:

$ codesign -dv --entitlements - "/Applications/Microsoft Teams (work or school).app/Contents/Helpers/com.microsoft.teams2.modulehost.app"
Executable=/Applications/Microsoft Teams (work or school).app/Contents/Helpers/com.microsoft.teams2.modulehost.app/Contents/MacOS/com.microsoft.teams2.modulehost
Identifier=com.microsoft.teams2
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=165792 flags=0x10000(runtime) hashes=5170+7 location=embedded
Signature size=9012
Timestamp=29 Mar 2024 at 05:04:18
Info.plist entries=29
TeamIdentifier=UBF8T346G9
Runtime Version=14.2.0
Sealed Resources version=2 rules=13 files=1
Internal requirements count=1 size=180
[Dict]
    [Key] com.apple.security.cs.allow-jit
    [Value]
        [Bool] true
    [Key] com.apple.security.cs.disable-library-validation
    [Value]
        [Bool] true
    [Key] com.apple.security.personal-information.location
    [Value]
        [Bool] true

The program is compiled using the Hardened Runtime, a security feature which aims, among other things, to prevent dynamically linked library hijacking.
However, the program includes this specific entitlement:

[Key] com.apple.security.cs.disable-library-validation
[Value]
    [Bool] true

With this entitlement enabled, the program’s defense against library hijacking is effectively nullified, as it allows the loading of unsigned dynamic libraries. This is an issue because a malicious application could leverage modulehost’s permissions without proper authorization.

The Info.plist content of modulehost is the following:

$ defaults read  "/Applications/Microsoft Teams (work or school).app/Contents/Helpers/com.microsoft.teams2.modulehost.app/Contents/Info"
{
    [...]
    NSBluetoothAlwaysUsageDescription = "Microsoft Teams wants to access your bluetooth devices for use in calls.";
    NSBluetoothPeripheralUsageDescription = "This app needs access to Bluetooth";
    NSCameraUsageDescription = "Microsoft Teams needs access to the camera for your calls";
    NSFocusStatusUsageDescription = "Microsoft Teams wants to access your focus status to show notifications.";
    NSLocationUsageDescription = "Microsoft Teams wants to access your location in case of an emergency.";
    NSMicrophoneUsageDescription = "Microsoft Teams needs access to the microphone for your calls";
    [...]
}

Essentially, each of these <feature>UsageDescription lines explain to the user the reasons why the app needs access to certain <feature>. When the helper app requests a permission that hasn’t been granted yet, it will appear to the user as though the main Microsoft Teams app is making the request.

An attacker could copy the application to a location they control and perform a library injection to use the permission of the main app through modulehost. This could allow the attacker to take photos, record audio, exfiltrate data, and more.
In scenarios where the attacker leverages permissions already granted to Teams, or when Apple Events are sent to other Microsoft apps under the scope of the com.apple.security.temporary-exception.apple-events entitlement — defined in the main Teams app — the system will not display a pop-up permission prompt, executing actions straightaway.
However, in cases where the required permission hasn’t yet been granted, the Microsoft Teams app will initiate the request. This could lead users to potentially grant the permission based on their trust in the Microsoft app.

Because of the use of the com.apple.security.cs.disable-library-validation entitlement set to true, a malicious application could perform a library injection in com.microsoft.teams2.modulehost.app without any special permission.

VENDOR RESPONSE

Microsoft fixed this issue in version 24124.1412.2911.3341

TIMELINE

2024-05-13 - Vendor Disclosure
2024-06-07 - Vendor Patch Release
2024-08-19 - Public Release