Postbox Dynamic Library Injection Vulnerability Allowing TCC Bypass on macOS

A vulnerability in Postbox version 7.0.65 for macOS allows for dynamic library injection, bypassing Transparency, Consent, and Control (TCC) mechanisms. This issue arises from the application's entitlements, which permit the use of environment variables to inject code into the application's context. While the injected code can access resources based on previously granted user permissions, accessing additional resources requires user interaction with a system prompt. The original company behind Postbox is no longer operational, and the software will not receive further updates. The acquiring company, eM Client, did not cooperate in the vulnerability disclosure process.

Impact

Exploitation of this vulnerability allows for dynamic library injection, enabling a local attacker to execute arbitrary code within the context of the Postbox application and bypass TCC controls.