/CVE-2021-40531

Quarantine bypass and RCE vulnerability in Sketch (proof-of-concept)

Primary LanguageHTML

CVE-2021-40531

Exploit Demo

This proof-of-concept in action.

Sketch is a popular UI/UX design app for macOS. This post covers a vulnerability in Sketch that I discovered back in July, CVE-2021-40531. In its simplest form, it is a macOS quarantine bypass, but in context it can be used for remote code execution.

For more details, see my blog post for a complete writeup.

Notes

If you are testing this proof-of-concept locally, be aware that feed.rss expects your web server to be running on port 8080.