CVE-2024-22405 (published 2024-04-30T10:15Z)

XADMaster is an objective-C library for archive and file unarchiving and extraction. When extracting a specially crafted zip archive XADMaster may not apply quarantine attribute correctly. Such behaviour may circumvent Gatekeeper checks on the system. Only macOS installations are affected. This issue was fixed in XADMaster 1.10.8. It is recommended to upgrade to the latest version. There are no known workarounds for this issue.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/MacPaw/XADMaster
commit_details: repo_url: https://github.com/MacPaw/XADMaster
author: Paul Taykalo
author_date: 2023-10-10 22:53:05+03:00
msg: Make sure that quarantine attribute is applied to all directories, not only in the child ones (#157)
repository: repo_url: https://github.com/MacPaw/XADMaster
repo_name: MacPaw/XADMaster
description: Objective-C library for archive and file unarchiving and extraction
repo_language: C
owner: MacPaw
file_changes: filename: XADArchive.m
change_type: ModificationType.MODIFY
diff: @@ -1041,8 +1041,12 @@ fileFraction:(double)fileprogress estimatedTotalFraction:(double)totalprogress
 	else return NO;
 }
 
-
-
+-(void)unarchiver:(XADUnarchiver *)unarchiver didCreateDirectory:(NSString *)directory
+{
+    if(delegate) {
+        [delegate archive:self didCreateDirectory:directory];
+    }
+}
 
 
 //
@@ -1147,6 +1151,9 @@ fileFraction:(double)fileprogress estimatedTotalFraction:(double)totalprogress
 -(BOOL)archive:(XADArchive *)arc shouldCreateDirectory:(NSString *)directory
 { return [delegate archive:arc shouldCreateDirectory:directory]; }
 
+-(void)archive:(XADArchive *)arc didCreateDirectory:(NSString *)directory
+{ [delegate archive:arc didCreateDirectory:directory]; }
+
 -(XADAction)archive:(XADArchive *)arc entry:(int)n collidesWithFile:(NSString *)file newFilename:(NSString **)newname
 { return [delegate archive:arc entry:n collidesWithFile:file newFilename:newname]; }
 
@@ -1207,6 +1214,7 @@ fileFraction:(double)fileprogress estimatedTotalFraction:(double)totalprogress
 
 -(BOOL)archiveExtractionShouldStop:(XADArchive *)archive { return NO; }
 -(BOOL)archive:(XADArchive *)archive shouldCreateDirectory:(NSString *)directory { return YES; }
+-(void)archive:(XADArchive *)archive didCreateDirectory:(NSString *)directory { }
 -(XADAction)archive:(XADArchive *)archive entry:(int)n collidesWithFile:(NSString *)file newFilename:(NSString **)newname { return XADOverwriteAction; }
 -(XADAction)archive:(XADArchive *)archive entry:(int)n collidesWithDirectory:(NSString *)file newFilename:(NSString **)newname { return XADSkipAction; }
 -(XADAction)archive:(XADArchive *)archive creatingDirectoryDidFailForEntry:(int)n { return XADAbortAction; }

programming_language: Objective-C
filename: XADSimpleUnarchiver.m
change_type: ModificationType.MODIFY
diff: @@ -870,6 +870,12 @@
 	return YES;
 }
 
+-(void)unarchiver:(XADUnarchiver *)unarchiver didCreateDirectory:(NSString *)directory {
+    if(propagatemetadata && metadata) {
+        [XADPlatform writeCloneableMetadata:metadata toPath:directory];
+    }
+}
+
 -(BOOL)unarchiver:(XADUnarchiver *)unarchiver shouldDeleteFileAndCreateDirectory:(NSString *)directory
 {
 	// If a resource fork entry for a directory was accidentally extracted

programming_language: Objective-C
filename: XADUnarchiver.h
change_type: ModificationType.MODIFY
diff: @@ -120,6 +120,7 @@ outputTarget:(id)target selector:(SEL)sel argument:(id)arg;
 -(void)unarchiver:(XADUnarchiver *)unarchiver didExtractEntryWithDictionary:(NSDictionary *)dict to:(NSString *)path error:(XADError)error;
 
 -(BOOL)unarchiver:(XADUnarchiver *)unarchiver shouldCreateDirectory:(NSString *)directory;
+-(void)unarchiver:(XADUnarchiver *)unarchiver didCreateDirectory:(NSString *)directory;
 -(BOOL)unarchiver:(XADUnarchiver *)unarchiver shouldDeleteFileAndCreateDirectory:(NSString *)directory;
 
 -(BOOL)unarchiver:(XADUnarchiver *)unarchiver shouldExtractArchiveEntryWithDictionary:(NSDictionary *)dict to:(NSString *)path;

programming_language: Objective-C
filename: XADUnarchiver.m
change_type: ModificationType.MODIFY
diff: @@ -562,11 +562,21 @@ deferDirectories:(BOOL)defer
 
 	#if MAC_OS_X_VERSION_MIN_REQUIRED>=1050 || __IPHONE_OS_VERSION_MIN_REQUIRED>__IPHONE_2_0
 	if([manager createDirectoryAtPath:path
-	withIntermediateDirectories:NO attributes:nil error:NULL]) return XADNoError;
+          withIntermediateDirectories:NO attributes:nil error:NULL]) {
+        if (delegate) {
+            [delegate unarchiver:self didCreateDirectory:path];
+        }
+        return XADNoError;
+    }
 	#else
-	if([manager createDirectoryAtPath:path attributes:nil]) return XADNoError;
+    if([manager createDirectoryAtPath:path attributes:nil]) {
+        if (delegate) {
+            [delegate unarchiver:self didCreateDirectory:path];
+        }
+        return XADNoError;
+    }
 	#endif
-	else return XADMakeDirectoryError;
+    else return XADMakeDirectoryError;
 }
 
 
@@ -745,6 +755,7 @@ outputTarget:(id)target selector:(SEL)selector argument:(id)argument
 -(void)unarchiver:(XADUnarchiver *)unarchiver didExtractEntryWithDictionary:(NSDictionary *)dict to:(NSString *)path error:(XADError)error {}
 
 -(BOOL)unarchiver:(XADUnarchiver *)unarchiver shouldCreateDirectory:(NSString *)directory { return YES; }
+-(void)unarchiver:(XADUnarchiver *)unarchiver didCreateDirectory:(NSString *)directory { }
 -(BOOL)unarchiver:(XADUnarchiver *)unarchiver shouldDeleteFileAndCreateDirectory:(NSString *)directory { return NO; }
 
 -(BOOL)unarchiver:(XADUnarchiver *)unarchiver shouldExtractArchiveEntryWithDictionary:(NSDictionary *)dict to:(NSString *)path { return NO; }

programming_language: Objective-C