CVE-2024-39804
📋 TL;DR
A library injection vulnerability in Microsoft PowerPoint 16.83 for macOS allows malicious applications to inject specially crafted libraries, leveraging PowerPoint's access privileges to bypass permissions. This affects macOS users running the vulnerable version of PowerPoint, potentially enabling privilege escalation.
💻 Affected Systems
- Microsoft PowerPoint
📦 What is this software?
Powerpoint by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains elevated privileges on the macOS system, potentially accessing sensitive files, installing malware, or compromising user data using PowerPoint's permissions.
Likely Case
Local privilege escalation where a malicious application abuses PowerPoint's permissions to perform unauthorized actions, such as reading protected files or executing commands with higher privileges.
If Mitigated
Limited impact if proper application sandboxing and least privilege principles are enforced, restricting PowerPoint's access to sensitive resources.
🎯 Exploit Status
Exploitation requires a malicious application to inject a library and start PowerPoint, implying some level of user interaction or local compromise. No public proof-of-concept has been disclosed as per the references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update Guide for the latest patched version; typically, updates are released via Microsoft AutoUpdate or Office updates.
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-39804
Restart Required: Yes
Instructions:
1. Open Microsoft PowerPoint on macOS. 2. Go to Help > Check for Updates. 3. Install any available updates. 4. Restart PowerPoint and the system if prompted.
🔧 Temporary Workarounds
Restrict PowerPoint Execution
macOSLimit PowerPoint's execution to reduce attack surface by using macOS sandboxing or application controls.
sudo spctl --master-enable
sudo spctl --enable --label "Microsoft PowerPoint"
Use Least Privilege
macOSRun PowerPoint with reduced privileges or in a restricted user account to minimize impact if exploited.
🧯 If You Can't Patch
- Disable or uninstall Microsoft PowerPoint if not needed to eliminate the vulnerability.
- Implement strict application whitelisting to prevent unauthorized applications from running alongside PowerPoint.
🔍 How to Verify
Check if Vulnerable:
Check the PowerPoint version: Open PowerPoint, go to PowerPoint > About PowerPoint, and verify if version is 16.83.Check Version:
defaults read /Applications/Microsoft\ PowerPoint.app/Contents/Info.plist CFBundleShortVersionStringVerify Fix Applied:
After updating, confirm the version is no longer 16.83 by checking in PowerPoint > About PowerPoint.📡 Detection & Monitoring
Log Indicators:
- Unusual library loading events in macOS system logs (e.g., Console app) related to PowerPoint.
- Suspicious process injections or privilege escalation attempts logged by security tools.
Network Indicators:
- No direct network indicators as this is a local vulnerability.
SIEM Query:
source="macos_system_logs" AND process="Microsoft PowerPoint" AND event="library injection" OR "privilege escalation"