CVE-2024-41145: Microsoft Teams Privilege Escalation Flaw

CVE-2024-41145 Overview

A library injection vulnerability exists in the WebView.app helper application of Microsoft Teams (work or school) version 24046.2813.2770.1094 for macOS. This vulnerability allows a specially crafted library to leverage Teams's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability, subsequently making use of the vulnerable application's permissions.

Critical Impact

Attackers can bypass permission controls on macOS by exploiting Microsoft Teams' elevated privileges, potentially gaining unauthorized access to sensitive system resources including camera, microphone, and file system access that Teams has been granted.

Affected Products

• Microsoft Teams (work or school) version 24046.2813.2770.1094 for macOS
• Microsoft Teams WebView.app helper application

Discovery Timeline

• 2024-12-18 - CVE-2024-41145 published to NVD
• 2025-08-26 - Last updated in NVD database

Technical Details for CVE-2024-41145

Vulnerability Analysis

This library injection vulnerability targets the WebView.app helper application bundled with Microsoft Teams for macOS. The vulnerability is classified under CWE-347 (Improper Verification of Cryptographic Signature), indicating that the application fails to properly verify the integrity or authenticity of dynamically loaded libraries. This allows attackers to inject malicious code that executes with the same privileges as Microsoft Teams.

The attack is particularly concerning because Microsoft Teams typically has extensive permissions on macOS systems, including access to the camera, microphone, screen recording capabilities, and file system access. An attacker successfully exploiting this vulnerability could inherit all of these permissions without user consent or notification.

Root Cause

The root cause stems from improper verification of dynamically loaded libraries in the WebView.app helper application. The application does not adequately validate the cryptographic signatures or integrity of libraries before loading them into its process space. This allows a malicious actor to substitute or inject a rogue library that the application will load and execute with its full privilege set.

On macOS, applications are typically granted permissions through the Transparency, Consent, and Control (TCC) framework. By injecting code into a trusted application like Microsoft Teams that has already been granted sensitive permissions, attackers can effectively bypass these security controls.

Attack Vector

The attack requires a malicious application to be present on the target macOS system. The attacker would craft a malicious dynamic library designed to be injected into the Teams WebView.app process. When Teams launches and loads the helper application, the injected library executes with Teams' full permission set.

The injection technique exploits macOS library loading mechanisms. By positioning a malicious library in a location where the vulnerable application will load it, or by manipulating environment variables and dyld configurations, attackers can force the application to execute their code. This enables privilege escalation from a standard user application to one with significant system access.

For detailed technical analysis, see the Talos Intelligence Vulnerability Report.

Detection Methods for CVE-2024-41145

Indicators of Compromise

• Unexpected dynamic libraries loaded into Microsoft Teams or WebView.app processes
• Suspicious dylib files in Teams application bundle or related directories
• Unusual process trees showing Teams spawning unexpected child processes
• Modified or non-standard library paths being accessed by Teams processes

Detection Strategies

• Monitor for abnormal library loading events in Microsoft Teams processes using macOS endpoint detection tools
• Implement code signing verification checks to detect unsigned or invalidly signed libraries being loaded
• Use behavioral analysis to detect Teams accessing resources outside its normal operational scope
• Deploy SentinelOne Singularity to detect process injection and library hijacking attempts in real-time

Monitoring Recommendations

• Enable verbose logging for the WebView.app helper application and Microsoft Teams processes
• Configure alerts for any new or modified dylib files within the Teams application bundle
• Monitor TCC database access patterns for anomalous permission usage by Teams
• Implement file integrity monitoring on the Microsoft Teams installation directory

How to Mitigate CVE-2024-41145

Immediate Actions Required

• Update Microsoft Teams for macOS to the latest available version from Microsoft
• Review and restrict permissions granted to Microsoft Teams in System Preferences > Privacy & Security
• Audit systems for any signs of compromise or unauthorized library injections
• Implement application allowlisting to prevent unauthorized code execution

Patch Information

Organizations should check for updated versions of Microsoft Teams for macOS that address this vulnerability. Visit the official Microsoft Teams download page or use the built-in update mechanism to obtain the latest patched version. Review the Talos Intelligence Vulnerability Report for additional details and remediation guidance.

Workarounds

• Restrict write access to the Microsoft Teams application bundle directory to prevent library injection
• Consider temporarily revoking sensitive permissions (camera, microphone) from Microsoft Teams until patching is complete
• Deploy endpoint detection and response (EDR) solutions to monitor for and block injection attempts
• Use macOS Gatekeeper and SIP (System Integrity Protection) enforcement to limit untrusted code execution

# Configuration example
# Check Microsoft Teams code signature integrity
codesign --verify --verbose=4 /Applications/Microsoft\ Teams.app

# List current TCC permissions for Microsoft Teams
sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \
  "SELECT * FROM access WHERE client LIKE '%teams%';"

# Monitor library loading for Teams processes
sudo dtrace -n 'syscall::open*:entry /execname == "Microsoft Teams"/ { printf("%s", copyinstr(arg0)); }'