Bypassing TCC Policies in Rocket.Chat Application for macOS

CVE-2024-8270

What is CVE-2024-8270?

The Rocket.Chat application for macOS has a significant vulnerability that allows attackers to bypass Transparency, Consent, and Control (TCC) policies. This flaw enables the exploitation of permissions, including access to the microphone and camera, through improper application signing and lack of Hardened Runtime usage. The absence of Library Validation can lead to DYLIB injection attacks, allowing unauthorized actions and the escalation of permissions beyond the intended application profile, thereby compromising user security.

References