BinaryNights ForkLift 3.4 was compiled with the com.apple.security.cs.disable-library-validation flag enabled which allowed a local attacker to inject code into ForkLift. This would allow the attacker to run malicious code with escalated privileges through ForkLift’s helper tool.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27192
Reference (s):
- https://insinuator.net/2020/11/forklift-lpe/