FORCEDENTRY Sandbox Escape via NSExpression
Ian Beer and Samuel Groß (back in March):
It’s clearly a serialized NSKeyedArchiver. Definitely not what you’d expect to see in a
JBIG2Bitmapobject. Runningstringswe see plenty of interesting things[…][…]
NSPredicatesusing theFUNCTIONkeyword are effectively Objective-C scripts. With some tricks it’s possible to build nested function calls which can do almost anything you could do in procedural Objective-C. Figuring out some of those tricks was the key to the 2019 Real World CTFDezhouInstrumenz challenge, which would evaluate an attacker suppliedNSExpressionformat string. The writeup by the challenge author is a great introduction to these ideas[…][…]
Prior to iOS 14.5 the isa field of an Objective-C object was not protected by Pointer Authentication Codes (PAC), so the JBIG2 machine builds a fake Objective-C object with a fake isa such that the invocation of the
deallocselector causes the deserialization and evaluation of theNSFunctionExpression. This is very similar to the technique used by Samuel in the 2020 SLOP post.[…]
Perhaps the most striking takeaway is the depth of the attack surface reachable from what would hopefully be a fairly constrained sandbox.
Previously:
- FORCEDENTRY iMessage Zero-click Remote Code Execution
- iMessage, NSKeyedArchiver, and _NSDataFileBackedFuture
