Viscosity OpenVPN TCC Bypass Vulnerability on macOS

A vulnerability exists in Viscosity OpenVPN on macOS that allows a Launch Agent to load a dynamic library with Viscosity's TCC (Transparency, Consent, and Control) identity. This could be exploited to access certain resources, limited to user-granted permissions for file resources. Access to other resources, such as the camera or microphone, requires user interaction with a system prompt. The vulnerability has been fixed in Viscosity version 1.11.5.

Impact

Exploitation of this vulnerability could lead to unauthorized access to file resources, bypassing macOS's TCC controls.

Remediation

Users can upgrade to Viscosity version 1.11.5 to address this vulnerability.