Cross-Site Escape - Pwning macOS Safari Sandbox the Unusual Way

This talk examines three macOS Safari sandbox escape techniques that exploit privileged WebViews, inter-process communication, URL schemes, and legacy components. It includes case studies involving local file disclosure and arbitrary native code execution without memory corruption.

Syllabus

Intro
Comparation
TOCTOU Without Racing
Web Content Case Study
Timeline for Web Content
Dashboard Widgets
Turning to Arbitrary Widget installation
Sandbox Escape
Problems
Triggering Execution
Hard Coded Trusted Schemes
Legacy Help
Sandbox is...gone
(Failed) Local File Disclosure
Some Drama
CVE-2020-9979: We Got Trust Issue
Dictionary App
Arbitrary File Execution
Local File Execution
How do we jump to Dictionary?
Jump to Dictionary.app
Summary
Takeaways