# CVE-2024-54471: macOS NetAuthAgent MIG Server Flaw Enables Credential Leakage and iCloud Data Access

> A missing sender/entitlement check in the macOS NetAuthAgent MIG server (com.apple.netauth.user.gui, routine 19 / message ID 40219) lets any local process query stored internet-password credentials, and from there decrypt an on-disk iCloud account file and obtain long-lived iCloud API tokens. Apple fixed it on 2024-10-28 with an entitlement check; the researcher states there is no evidence of malicious use.

- **Published:** 2026-10-30T15:21:46Z
- **Last reviewed:** 2026-10-30T15:21:46Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4835
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4835.png
- **ID:** TL-2026-4835
- **Severity:** MEDIUM (CVSS 5.5)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 5
- **CVEs:** CVE-2024-54471

## Description

NetAuthAgent is a macOS user-agent daemon that handles credentials for file servers (FTP, Samba, WebDAV). It exposes a Mach Interface Generator (MIG) server registered in the bootstrap namespace as com.apple.netauth.user.gui with base routine ID 40200. Before the fix, the server did not verify who sent a message. Routine 19 (message ID 40219) accepted a serialized property-list dictionary (keys Scheme, Host, AlternatePort, Path) and returned the matching username and password in out-of-line data descriptors, so any local application could use NetAuthAgent as a credential proxy for keychain items of class 'internet password' that NetAuthAgent is allowed to read.

The same primitive extends to iCloud. According to the researcher (Noah Gregory, published on the Objective-See Foundation blog on 2025-03-20), a keychain item present on essentially every macOS device holds the decryption key for an on-disk file containing iCloud account information (names, email addresses, aliases, enabled features and multiple long-lasting iCloud API tokens). Because NetAuthAgent could be made to return that key, an unprivileged local process could decrypt the file and use the tokens to reach contacts, calendars, Find My data (own devices and friends' locations, plus lock/erase/sound actions), iCloud key-value store data, iCloud backup metadata (including device serial numbers) and read-only CloudKit queries. The researcher notes that earlier work by Wojciech Regula (Securing.pl) described iCloud token exposure and its uses. In corporate settings the same primitive could expose SSO or file-server credentials usable for lateral movement.

The researcher used a Swift Mach-message research tool named Kass to build a MIG client for the service and to enumerate keychain items via SecItemCopyMatching with kSecClassInternetPassword. Vulnerable MIG servers can be located by searching Mach-O binaries for the NDR_record symbol (e.g. with the ipsw CLI). The fix makes NetAuthAgent read the sender's audit token from the kernel-appended message trailer, fetch the sender's entitlements, and refuse the message unless the entitlement com.apple.private.netauth.useragent.allow is true; AMFI constrains third-party apps from claiming restricted entitlements.

Apple shipped the fix in macOS Sequoia 15.1, Sonoma 14.7.1 and Ventura 13.7.1 on 2024-10-28 and added the CVE entry to its advisories on 2024-12-11 (impact: 'A malicious application may be able to leak a user's credentials'). NVD scores it CVSS 3.1 5.5 (MEDIUM), CWE-522. The CVE is not listed in CISA KEV, and the researcher states there is no evidence it was ever used or found by malicious actors. No network IOCs, malware samples or threat-actor attribution are associated with it.

## MITRE ATT&CK

- T1559 Inter-Process Communication
- T1212 Exploitation for Credential Access
- T1555.001 Keychain
- T1528 Steal Application Access Token
- T1005 Data from Local System
- T1530 Data from Cloud Storage
- T1550.001 Application Access Token
- T1078.004 Cloud Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**iCloud API Access by Scripting Clients or Non-Apple Processes (Stolen Token Use) — C2 / Lateral Movement (SPL)** (`TL-2026-4835-SPL-003`)

Detects use of stolen long-lived iCloud API tokens: curl, python, node, ruby, perl or swift command lines targeting iCloud service hosts (setup, gateway, fmipmobile, and pNN- contacts, calendars, keyvalueservice, ckdatabase, fmip, quota), and non-Apple processes connecting to icloud.com hosts. These tokens, recoverable via CVE-2024-54471, give access to contacts, calendars, Find My, key-value store, backup metadata and CloudKit from any host, so token use from unexpected systems is the post-exploitation signal.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1550.001, T1078.004, T1530, T1528
- **Data sources:** osquery, microsoft_defender_for_endpoint
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

```spl
index=macos sourcetype="osquery:results" earliest=-24h
| eval proc=lower(coalesce(path, process_path, "")), cmd=lower(coalesce(cmdline, command_line, "")), dhost=lower(coalesce(dest_host, remote_hostname, ""))
| where (match(cmd, "(curl|wget|python|node|ruby|perl|swift)") AND match(cmd, "(setup|gateway|fmipmobile|p[0-9]+-(contacts|calendars|keyvalueservice|ckdatabase|fmip|quota))[.]icloud[.]com")) OR (match(dhost, "[.]icloud[.]com$") AND NOT match(proc, "^(/system/|/usr/libexec/|/applications/|/library/apple/)"))
| stats count values(proc) as processes values(dhost) as icloud_hosts values(cmd) as commands by host
| table host processes icloud_hosts commands count
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl endswith ".icloud.com"
| where InitiatingProcessFolderPath !startswith "/System/" and InitiatingProcessFolderPath !startswith "/usr/libexec/" and InitiatingProcessFolderPath !startswith "/Applications/" and InitiatingProcessFolderPath !startswith "/Library/Apple/"
| summarize Connections = count(), Hosts = make_set(RemoteUrl, 20), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine
| project DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, Connections, Hosts, FirstSeen, LastSeen
```

### Sigma

```yaml
title: Scripting Client Calling iCloud API Hosts on macOS (Stolen iCloud Token Use, CVE-2024-54471)
id: b4d8e3f7-61c2-4c9a-a7e5-9f2d1c0b8a03
status: experimental
description: Detects curl, python, node, ruby or perl command lines targeting iCloud service hosts such as setup, gateway, fmipmobile, contacts, calendars, keyvalueservice, ckdatabase and fmip, consistent with replay of long-lived iCloud API tokens obtained through the NetAuthAgent flaw (CVE-2024-54471).
references:
    - https://objective-see.org/blog/blog_0x7E.html
    - https://wts.dev/posts/password-leak/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-30
tags:
    - attack.credential_access
    - attack.t1528
    - attack.defense_evasion
    - attack.t1550.001
    - attack.collection
    - attack.t1530
    - attack.initial_access
    - attack.t1078.004
    - cve.2024-54471
logsource:
    category: process_creation
    product: macos
detection:
    selection_img:
        Image|endswith:
            - '/curl'
            - '/python'
            - '/python3'
            - '/node'
            - '/ruby'
            - '/perl'
    selection_host:
        CommandLine|contains:
            - 'setup.icloud.com'
            - 'gateway.icloud.com'
            - 'fmipmobile.icloud.com'
            - '-contacts.icloud.com'
            - '-calendars.icloud.com'
            - '-keyvalueservice.icloud.com'
            - '-ckdatabase.icloud.com'
            - '-fmip.icloud.com'
    condition: selection_img and selection_host
falsepositives:
    - Developers testing iCloud or CloudKit APIs from scripts
    - Legitimate third-party sync or backup tooling that calls iCloud endpoints
level: medium
```

**Known false positives:**

- Developers testing iCloud or CloudKit APIs from scripts
- Legitimate third-party sync or backup applications connecting to icloud.com

**Tuning notes:** Map dest_host/remote_hostname to your network or DNS telemetry field. The /Applications exclusion hides legitimate apps but also malicious apps installed there; baseline signed third-party iCloud clients and tighten the exclusion by signing ID. Correlate with the iCloud account file or keychain detections on the same host and with iCloud-side session reviews.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2024-54471 NetAuthAgent MIG Service Abuse or Kass/ipsw MIG Tooling — Exploitation (KQL) (locked: unlock with TL Creds)
- macOS Keychain Internet-Password and iCloud Account File Access by Non-Apple Process — Post-Exploitation (KQL) (locked: unlock with TL Creds)
- iCloud API Access by Scripting Clients or Non-Apple Processes (Stolen Token Use) — C2 / Lateral Movement (KQL) (locked: unlock with TL Creds)
- CVE-2024-54471 NetAuthAgent MIG Service Abuse or Kass/ipsw MIG Tooling — Exploitation (Sigma) (locked: unlock with TL Creds)
- macOS Keychain Internet-Password and iCloud Account File Access by Non-Apple Process — Post-Exploitation (Sigma) (locked: unlock with TL Creds)
- iCloud API Access by Scripting Clients or Non-Apple Processes (Stolen Token Use) — C2 / Lateral Movement (Sigma) (locked: unlock with TL Creds)
- CVE-2024-54471 NetAuthAgent MIG Service Abuse or Kass/ipsw MIG Tooling — Exploitation (SPL) (locked: unlock with TL Creds)
- macOS Keychain Internet-Password and iCloud Account File Access by Non-Apple Process — Post-Exploitation (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Leaking Passwords...and more on macOS (Objective-See, Noah Gregory)](https://objective-see.org/blog/blog_0x7E.html)
- [Password leak write-up (Noah Gregory, wts.dev)](https://wts.dev/posts/password-leak/)
- [About the security content of macOS Sequoia 15.1](https://support.apple.com/en-us/121564)
- [About the security content of macOS Sonoma 14.7.1](https://support.apple.com/en-us/121570)
- [About the security content of macOS Ventura 13.7.1](https://support.apple.com/en-us/121568)
- [NVD - CVE-2024-54471](https://nvd.nist.gov/vuln/detail/CVE-2024-54471)
- [Hacker News discussion of the Objective-See post](https://news.ycombinator.com/item?id=43425605)
- [Rapid7 vulnerability database: Apple OSX NetAuth CVE-2024-54471](https://www.rapid7.com/db/vulnerabilities/apple-osx-netauth-cve-2024-54471/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4835