CVE-2024-54477: Apple macOS Information Disclosure Flaw

CVE-2024-54477 Overview

CVE-2024-54477 is a sensitive data exposure vulnerability affecting multiple versions of Apple macOS. The vulnerability stems from insufficient validation checks that allow a malicious application to access user-sensitive data. Apple addressed this issue with improved checks in macOS Sequoia 15.2, macOS Ventura 13.7.2, and macOS Sonoma 14.7.2.

Critical Impact

A malicious application running on an affected macOS system may be able to access user-sensitive data, potentially leading to privacy breaches and unauthorized disclosure of confidential information.

Affected Products

• Apple macOS Sequoia (versions prior to 15.2)
• Apple macOS Ventura (versions prior to 13.7.2)
• Apple macOS Sonoma (versions prior to 14.7.2)

Discovery Timeline

• 2024-12-12 - CVE-2024-54477 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-54477

Vulnerability Analysis

This vulnerability is classified under CWE-922 (Insecure Storage of Sensitive Information), indicating that the affected macOS components failed to properly protect user-sensitive data from unauthorized access. The flaw requires local access and low-privilege authentication to exploit, meaning an attacker would need to execute a malicious application on the target system.

The vulnerability allows an application to bypass intended access restrictions and read sensitive user data that should be protected by the operating system's security controls. This represents a significant confidentiality impact, as sensitive personal information could be exfiltrated without user awareness.

Root Cause

The root cause of CVE-2024-54477 lies in inadequate validation checks within macOS components responsible for controlling access to user-sensitive data. The insufficient checks allowed applications to access protected data storage locations or APIs without proper authorization verification. Apple addressed this by implementing improved validation checks to ensure proper access control enforcement.

Attack Vector

The attack vector for CVE-2024-54477 is local, requiring an attacker to have the ability to execute code on the target macOS system. The exploitation scenario involves a malicious application that exploits the insufficient validation checks to access user-sensitive data.

An attacker could deliver the malicious application through various means including:

• Convincing users to download and execute trojanized applications
• Exploiting other vulnerabilities to achieve initial code execution
• Leveraging social engineering to install malware

Once executed, the malicious application can access sensitive data without requiring elevated privileges or additional user interaction. The vulnerability does not affect system integrity or availability, focusing solely on unauthorized data disclosure.

Detection Methods for CVE-2024-54477

Indicators of Compromise

• Unexpected application processes accessing protected user data directories or APIs
• Suspicious applications requesting or accessing sensitive data without legitimate business purpose
• Unusual data exfiltration patterns from user-sensitive storage locations

Detection Strategies

• Monitor for applications attempting to access protected data locations outside of normal operational patterns
• Implement endpoint detection rules to identify unauthorized access to sensitive user data stores
• Use behavioral analysis to detect applications exhibiting data harvesting behaviors

Monitoring Recommendations

• Enable comprehensive logging for data access events on macOS endpoints
• Monitor for newly installed or unsigned applications accessing sensitive user directories
• Implement SentinelOne Singularity Platform for real-time behavioral monitoring and threat detection on macOS systems

How to Mitigate CVE-2024-54477

Immediate Actions Required

• Update all affected macOS systems to the patched versions immediately
• Audit installed applications for any unauthorized or suspicious software
• Restrict application installation to trusted sources only (App Store or identified developers)
• Enable System Integrity Protection (SIP) if not already enabled

Patch Information

Apple has released security updates addressing this vulnerability. Apply the following updates based on your macOS version:

• macOS Sequoia: Update to version 15.2 or later - See Apple Security Advisory #121839
• macOS Ventura: Update to version 13.7.2 or later - See Apple Security Advisory #121840
• macOS Sonoma: Update to version 14.7.2 or later - See Apple Security Advisory #121842

Additional technical details are available in the Full Disclosure mailing list archives.

Workarounds

• Limit application execution to only trusted and verified software until patches can be applied
• Implement application allowlisting to prevent unauthorized applications from running
• Use macOS Gatekeeper and notarization requirements to restrict untrusted application execution

# Verify macOS version and check for available updates
sw_vers
softwareupdate --list

# Install available security updates
softwareupdate --install --all

# Verify System Integrity Protection is enabled
csrutil status