CVE-2024-8270
Awaiting Analysis Awaiting Analysis - Queue
BaseFortify

Publication date: 2025-06-11

Last updated on: 2025-06-12

Assigner: Pentraze

Description
The macOS Rocket.Chat application is affected by a vulnerability that allows bypassing Transparency, Consent, and Control (TCC) policies, enabling the exploitation or abuse of permissions specified in its entitlements (e.g., microphone, camera, automation, network client). Since Rocket.Chat was not signed with the Hardened Runtime nor set to enforce Library Validation, it is vulnerable to DYLIB injection attacks, which can lead to unauthorized actions or escalation of permissions. Consequently, an attacker gains capabilities that are not permitted by default under the Sandbox and its application profile.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-06-11
Last Modified
2025-06-12
Generated
2026-05-07
AI Q&A
2025-06-11
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in the macOS Rocket.Chat application allows attackers to bypass Transparency, Consent, and Control (TCC) policies, which normally restrict access to sensitive permissions like microphone, camera, automation, and network client. Because Rocket.Chat is not signed with the Hardened Runtime and does not enforce Library Validation, it is susceptible to DYLIB injection attacks. This means an attacker can inject malicious dynamic libraries to perform unauthorized actions or escalate permissions beyond what the app's sandbox and profile normally allow.


How can this vulnerability impact me? :

The impact of this vulnerability is that an attacker could gain unauthorized access to sensitive device capabilities such as the microphone, camera, automation features, or network client functions. This could lead to privacy violations, unauthorized data access, or control over certain device functions without the user's consent or knowledge.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart