CVE-2021-30657

What it actually does

CVE-2021-30657 is a macOS Gatekeeper authorization bypass caused by a logic flaw in state management. A malicious application can be crafted so that macOS fails to apply normal Gatekeeper checks before execution. Gatekeeper is intended to block or warn on untrusted, unsigned, improperly notarized, or quarantined applications downloaded from the internet; bypassing it allows attacker-supplied code to run despite those policy controls. The vulnerability requires user interaction because the victim must launch or otherwise open the malicious application, but it does not require attacker authentication or prior privileges. The main technical impact is integrity compromise: execution of untrusted code that should have been blocked by macOS application security controls.

Why it matters to the business

Successful exploitation can allow malware to run on macOS endpoints even where users and administrators rely on Gatekeeper to stop untrusted applications. This can lead to endpoint compromise, credential theft, data access through the user’s permissions, installation of persistence mechanisms, lateral movement attempts, and disruption of normal operations. The issue is listed in CISA KEV, has been observed as actively exploited in the wild, and had a CISA remediation deadline of 2021-11-17, so unpatched macOS systems should be treated as high-priority exposure even though the CVSS score is moderate. Organizations with large macOS fleets, remote users, or software distribution outside managed app stores face elevated operational risk because the attack path can begin with ordinary user interaction such as opening a downloaded application.

How an attack unfolds

An attacker prepares a specially crafted macOS application package that triggers the Gatekeeper logic flaw and avoids normal quarantine, notarization, or trust enforcement behavior. The attacker then delivers the application to a target through a common social-engineering channel such as a phishing email, malicious download page, fake software update, trojanized utility, or file-sharing link. When the user opens the application, macOS fails to perform the expected Gatekeeper checks, allowing the application to execute as if it were trusted or otherwise not subject to enforcement. Once running, the malicious application can perform actions available to the current user, such as dropping additional payloads, establishing persistence, contacting command-and-control infrastructure, collecting credentials or files, and attempting to bypass additional endpoint controls. Apple reported active exploitation, and CISA KEV status indicates defenders should assume real-world tradecraft exists for this bypass.

How to fix it

Upgrade affected macOS systems to versions containing Apple’s fix: macOS Big Sur 11.3 or later, or Security Update 2021-002 Catalina or later for Catalina systems. Where possible, move unsupported macOS versions to a supported release that still receives security updates. Enforce centralized macOS patch management and verify that all endpoints have received the relevant security update. As compensating controls, restrict execution from user-writable download locations, require managed software distribution for business applications, use endpoint protection capable of detecting unsigned or suspicious application bundles, monitor quarantine and notarization bypass behavior, and apply least-privilege controls so users do not routinely operate with administrative privileges. Because this vulnerability has been actively exploited and appears in CISA KEV, mitigation alone should not be considered sufficient for internet-facing or high-risk user populations if patching is possible.

How to confirm the fix worked

Confirm exposure by inventorying macOS versions and security update levels. Systems running macOS Big Sur earlier than 11.3 or Catalina without Security Update 2021-002 should be considered vulnerable. Validate remediation by checking that Big Sur systems report 11.3 or later, Catalina systems show Security Update 2021-002 or later installed, and managed device compliance tooling reflects the patched build across the fleet. Perform a sample verification using Apple software update history, MDM inventory, or the command line with sw_vers and softwareupdate --history. Also confirm that Gatekeeper remains enabled with spctl --status and that policies have not been weakened to allow applications from anywhere. For higher assurance, test that newly downloaded unsigned or unnotarized applications are blocked or warned as expected on patched systems.

Typical attack path

1. Attacker builds or obtains a malicious macOS application crafted to bypass Gatekeeper validation.
2. Attacker delivers the application using phishing, a fake download page, malvertising, software impersonation, or a compromised distribution channel.
3. Victim downloads and opens the application, satisfying the required user interaction.
4. The Gatekeeper logic flaw prevents expected trust or quarantine checks from blocking execution.
5. The malicious application runs with the permissions of the current user.
6. Payload establishes persistence, downloads follow-on malware, steals data or credentials, or performs reconnaissance for further compromise.

How to detect it

To determine whether exploitation already occurred, review macOS endpoint telemetry, EDR data, Unified Logs, file system artifacts, and network logs for suspicious application execution around the time users downloaded or opened files from the internet. Focus on applications launched from ~/Downloads, /tmp, /private/tmp, mounted disk images under /Volumes, extracted archives, and other user-writable locations, especially if they lack a valid Apple notarization ticket or developer signature. Examine quarantine metadata with xattr for downloaded files and compare it with execution history; suspicious cases include applications with missing or abnormal com.apple.quarantine attributes that nevertheless appear to have originated from browsers, mail clients, messaging tools, or archive utilities. Search Unified Logs for Gatekeeper, syspolicyd, trustd, XProtect, MRT, and LaunchServices events showing assessment failures, bypass-like behavior, or first execution of unusual bundles. Review process trees where Finder, Archive Utility, Safari, Chrome, Mail, or a disk image mount precedes execution of an unknown application, followed by shell commands, curl, osascript, Python, Perl, Ruby, launchctl, or network connections. Inspect common macOS persistence locations such as LaunchAgents, LaunchDaemons, login items, cron jobs, and application support directories for files created shortly after the suspicious app launch. Since public reporting for this record does not provide a single universal malware hash or command-and-control endpoint, detection should be behavior-based and correlated with the presence of vulnerable macOS versions before patching.

• /System/Library/Frameworks/Security.framework/Versions/Current/Helpers/syspolicyd
• com.apple.quarantine
• spctl --status
• /Users/*/Downloads/*.app
• /Users/*/Downloads/*.dmg
• /Volumes/*.app
• /private/tmp/*.app
• /tmp/*.app
• /Users/*/Library/LaunchAgents/*.plist
• /Library/LaunchAgents/*.plist
• /Library/LaunchDaemons/*.plist
• /Users/*/Library/Application Support/*
• /Library/Application Support/*
• /usr/bin/osascript
• /usr/bin/curl
• /usr/bin/python
• /usr/bin/python3
• /bin/bash
• /bin/sh
• /bin/zsh
• launchctl load
• launchctl bootstrap
• softwareupdate --history
• Security Update 2021-002
• macOS Big Sur 11.3

What your security team should do

• Immediately identify macOS endpoints below macOS Big Sur 11.3 or Catalina systems missing Security Update 2021-002 and prioritize remediation.
• Treat unpatched systems as high risk because the vulnerability is in CISA KEV and was reported as actively exploited in the wild.
• Patch or upgrade affected macOS devices; isolate or restrict high-risk unpatched systems until updated.
• Hunt for suspicious recently executed application bundles, especially those launched from Downloads, temporary folders, disk images, archives, or user-writable paths.
• Review endpoint telemetry for applications that executed without expected Gatekeeper prompts, unsigned binaries, ad hoc signatures, abnormal child processes, or first-run network connections.
• Ensure Gatekeeper is enabled and prevent users from disabling application security controls through configuration management.
• Restrict software installation to managed sources where feasible and educate users to avoid unsolicited macOS applications or fake update prompts.
• Increase monitoring for macOS persistence locations, launch agents, login items, and outbound connections created shortly after execution of newly downloaded applications.