Escaping the Microsoft Office Sandbox
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
A guest post on MDSec by Adam Chester describes how a faulty regex in Microsoft Word's macOS sandbox entitlements lets Office-launched malicious code write files anywhere matching a temporary-file pattern, such as into the user's LaunchAgents folder.