Lack of quarantine meta-attribute for downloaded files leads to GateKeeper bypass

业务逻辑 / 违反安全设计原则（按标题归类） / #374106

厂商

Brave Software

严重程度

低危

赏金

—

弱点

违反安全设计原则（按标题归类）

研究员

@metnew

披露日期

2019-09-12

资产

https://github.com/brave/browser-laptop

CVE

—

该报告还没有中文解读。

Executable files downloaded through Brave don't have quarantine attribute. That means it's possible to launch any executable bypassing codesigning + quarantine.