CVE-2021-30713

What it actually does

CVE-2021-30713 is a macOS local permission-validation flaw that allows a malicious application running on the system to bypass Apple Privacy preferences, commonly associated with Transparency, Consent, and Control (TCC) protections. Successful exploitation can let an app access protected user data or sensitive device capabilities without the expected user consent prompts or approved privacy-policy grants. Because the attacker needs local code execution, this issue is most often useful as a post-compromise privilege-abuse and data-access technique rather than an initial remote entry point.

Why it matters to the business

An attacker who tricks a user into running a malicious macOS application, or who already has local code execution through another compromise, may be able to access sensitive files, application data, screen contents, contacts, calendars, microphone/camera-protected resources, or other privacy-controlled data without normal approval. Apple reported active exploitation, and the issue is listed in CISA KEV with a remediation due date of 2021-11-17, so unpatched macOS endpoints should be treated as high-priority exposure even though the vulnerability is several years old. Operationally, this can lead to data theft, credential exposure, privacy violations, regulatory reporting obligations, and reduced trust in endpoint privacy controls.

How an attack unfolds

An attacker first gains the ability to execute a malicious application on a vulnerable macOS system, commonly through phishing, trojanized software, malicious browser downloads, or as a second stage after another exploit. Once running with local user privileges, the application abuses the flawed privacy-permission validation logic to bypass TCC enforcement rather than requesting legitimate user approval. The malicious app can then access protected resources or data that should normally require explicit consent or an MDM-approved privacy profile. After access is obtained, the attacker may collect documents, browser or application data, screenshots, contact data, or other sensitive information, then stage and exfiltrate it. Apple has acknowledged reports of active exploitation, so historical investigation should assume this technique may have been used by commodity or targeted macOS malware rather than only proof-of-concept activity.

How to fix it

Upgrade affected macOS systems to a version containing Apple’s fix. For macOS Big Sur, install macOS Big Sur 11.4 or later. Systems on older macOS branches should receive the corresponding Apple security updates where available or be upgraded to a currently supported macOS release. Where immediate patching is not possible, reduce risk by blocking untrusted application execution, enforcing application allowlisting where feasible, restricting local administrator rights, using MDM PPPC profiles only for approved applications, enabling Gatekeeper/XProtect/MRT updates, and monitoring or preventing unauthorized modification of TCC databases. Any system suspected of exploitation should be reimaged or thoroughly remediated after preserving forensic evidence, because the flaw may have allowed access to sensitive data rather than leaving a single reliable artifact.

How to confirm the fix worked

Confirm the operating system build is patched by inventorying macOS versions with tools such as `sw_vers -productVersion` and ensuring Big Sur systems are at 11.4 or later, or that other branches have received Apple security updates that include the fix. Validate that Apple security content and endpoint-management compliance reports show the relevant macOS update installed. Review MDM privacy profiles to ensure only expected applications have approved access to protected services. Audit user and system TCC databases for unexpected grants, especially for unknown, unsigned, recently downloaded, or user-writable applications. Confirm endpoint security controls are logging TCC database access, application execution from download/user-writable paths, and suspicious access to protected data locations.

Typical attack path

1. Deliver a malicious macOS application through phishing, trojanized installer, drive-by download, or another local-code-execution path.
2. Convince the user to launch the application or execute it through an existing foothold.
3. Abuse the permission-validation weakness to bypass macOS Privacy/TCC controls without a normal consent prompt.
4. Access protected files, user data, screen contents, or privacy-controlled services available through the bypass.
5. Package and exfiltrate collected data, or use the gained access to support broader credential theft, surveillance, or persistence.

How to detect it

Investigate both endpoint telemetry and macOS-native artifacts. Key sources include Apple Unified Logs, EDR process/file events, EndpointSecurity events, MDM inventory, Gatekeeper/quarantine logs, and TCC database contents. Look for unexpected writes to user or system TCC databases, new privacy grants for unknown applications, and protected-service access by binaries running from user-writable locations such as Downloads, temporary folders, mounted disk images, or application bundles without a trusted publisher. Review events involving `tccd`, `syspolicyd`, and suspicious applications around the same time. Examine `~/Library/Application Support/com.apple.TCC/TCC.db` and `/Library/Application Support/com.apple.TCC/TCC.db` for unexpected entries in the `access` table, especially grants for sensitive services such as Full Disk Access, Screen Capture, Accessibility, Camera, Microphone, Contacts, Calendars, Photos, AppleEvents, and developer tools. Because exploitation may not produce a unique network signature, correlate local artifacts with outbound connections from the suspicious process and with file-access events touching sensitive directories such as Desktop, Documents, Downloads, browser profiles, keychain-adjacent data, and application support folders.

• ~/Library/Application Support/com.apple.TCC/TCC.db
• /Library/Application Support/com.apple.TCC/TCC.db
• com.apple.TCC
• tccd
• kTCCServiceSystemPolicyAllFiles
• kTCCServiceScreenCapture
• kTCCServiceAccessibility
• kTCCServiceCamera
• kTCCServiceMicrophone
• kTCCServiceAddressBook
• kTCCServiceCalendar
• kTCCServicePhotos
• kTCCServiceAppleEvents
• /Users/*/Library/Application Support/com.apple.TCC/TCC.db
• /Library/Application Support/com.apple.TCC/TCC.db-wal
• /Library/Application Support/com.apple.TCC/TCC.db-shm
• ~/Library/Application Support/com.apple.TCC/TCC.db-wal
• ~/Library/Application Support/com.apple.TCC/TCC.db-shm

What your security team should do

• Prioritize remediation of any remaining vulnerable macOS endpoints because the issue is in CISA KEV and Apple reported active exploitation.
• Upgrade Big Sur systems to macOS 11.4 or later, and move unsupported macOS versions to a supported, patched release.
• Hunt for suspicious TCC database changes and unexpected privacy grants to unsigned, unknown, or recently downloaded applications.
• Review EDR and Unified Log telemetry around the first execution of suspicious macOS applications, especially from Downloads, temporary directories, mounted disk images, and user-writable paths.
• Audit MDM PPPC profiles and remove broad or stale privacy permissions that could mask malicious access.
• Treat confirmed exploitation as a potential data-exposure incident and investigate access to sensitive files, browser data, credentials, screen capture, and other privacy-protected resources.
• Block or quarantine known unwanted macOS malware families and require notarized, trusted software sources where operationally feasible.