macOS is susceptible to running arbitrary code when a user opens a malicious .inetloc file, and Apple's first attempt to silently fix the issue failed
Security researchers disclosed today a new vulnerability in Apple's macOS Finder, which makes it possible for attackers to run arbitrary commands …
BleepingComputerSergiu Gatlan
Context & Ripple Effects
The Finder disclosure lands in a longer run of macOS trust-boundary failures: an earlier Gatekeeper-scanning bypass and a 2021 flaw that let unnotarized apps run showed that Apple’s execution controls could be circumvented through more than one path.
The failed silent remediation makes patch delivery part of the security story. Later coverage of another Gatekeeper bypass fixed by Apple reinforces that code-execution safeguards, rather than a single Finder defect, are the recurring pressure point.
First-order effects
macOS Finder users who open malicious .inetloc files remain exposed to arbitrary-command execution until Apple supplies a fix that actually closes the reported path.
Apple must replace or revise its failed silent fix, putting its response process under scrutiny alongside the Finder vulnerability itself.
Second-order effects
Gatekeeper and notarization provide less practical protection when a Finder-handled file can trigger execution through a separate route, echoing the earlier unnotarized-app execution flaw.
Security teams managing Macs have a concrete reason to treat .inetloc files as a delivery risk while Apple’s remediation is incomplete, rather than relying solely on Apple’s silent update mechanism.
Third-order effects
Repeated weaknesses around Finder, Gatekeeper, and notarization point to macOS security becoming dependent on the consistency of interactions among its trust controls, not just on hardening individual components.
If that pattern persists, Apple will face pressure to make emergency security fixes more verifiable for administrators instead of relying on opaque background remediation.
The trend: macOS security is being tested at the seams between user-facing file handling and Apple’s app-execution trust controls.
⚠️ Latest macOS 0day (credit: Park Minchan) ...bypasses File Quarantine, Gatekeeper, etc. Advisory: 📝 “macOS Finder RCE” https://ssd-disclosure.com/... 😅 Confirmed Big Sur & Monterey are vulnerable 🧮 I've posted Park's PoC (pops Calc) if you'd like to play: https://objective-see.…
The bug, found by independent security researcher Park Minchan, is due to the way macOS processes inetloc files which inadvertently causes it to run any commands embedded by an attacker inside without any warnings or prompts. So, y'know. All good fam. https://www.bleepingcomputer…
New advisory is now out! Find out how a vulnerability in macOS Finder system allows remote attackers to trick users into running arbitrary commands. https://ssd-disclosure.com/... https://twitter.com/...
SSD Advisory - macOS Finder RCE: A vulnerability in macOS Finder system allows remote attackers to trick users into running arbitrary commands. https://ssd-disclosure.com/...
Orgs: “Well-resourced, nation state attackers used complex & highly sophisticated techniques to hack us.” Them: *Just hits the SHIFT key a couple times.* 🎗Remember folks: nobody has your back and pretty much no OS or app vendor cares about your safety. https://ssd-disclosure.com/…
2021 and Apple still does all they can to evade transparency. Their long checkered history with the CVE database isn't news, but that even today they release a security fix like this without an accompanying CVE is simply childish. https://www.bleepingcomputer.com/ ...
SSD Advisory - macOS Finder RCE: A vulnerability in macOS Finder system allows remote attackers to trick users into running arbitrary commands. https://www.reddit.com/...