# sqlol (CVE-2023-32422) - a macOS TCC bypass

SQLITE_SQLLOG_DIR env var in libsqlite writes attacker-controlled files following symlinks, allowing overwrite of TCC.db via sqlite smuggling to bypass macOS TCC.

- Payout: $30,500
- Severity: high
- Program: Apple
- Credited: Gergely Kalman
- Disclosed: 2023-11-15
- CVE: CVE-2023-32422
- Write-up quality: 8/10
- Original: https://gergelykalman.com/sqlol-CVE-2023-32422-a-macos-tcc-bypass.html
- Library page: https://bugbountylibrary.com/r/blog%3Agergelykalman-com-sqlol-cve-2023-32422-a-macos-tcc-bypass-html
- Tags: domain:desktop impact:data-leak impact:privesc kind:bounty platform:blog sev:high technique:chained technique:source-review vuln:info-disclosure vuln:privilege-escalation

**Target:** libsqlite SQLITE_SQLLOG_DIR debug functionality
**Root cause:** libsqlite compiled with SQLITE_ENABLE_SQLLOG enables SQLITE_SQLLOG_DIR env var to write debug files (full DB copies, SQL logs) to attacker-controlled directory with predictable filenames, following symlinks and overwriting files.
**Steps:**
1. Set `SQLITE_SQLLOG_DIR` to a directory controlled by attacker.
2. Trigger a privileged app (e.g., Music) that uses libsqlite to open a database.
3. Observe generated files: `sqllog_N.db` (full DB copy), `sqllog_N.sql`, `sqllog.idx`.
4. Create a symlink from `sqllog_N.db` to target file (e.g., `~/Library/Application Support/com.apple.TCC/TCC.db`).
5. Set `SQLITE_SQLLOG_REUSE_FILES=1` to keep filenames stable.
6. Trigger the app again to overwrite target with the DB copy.
7. For TCC bypass: craft a malicious sqlite DB containing a valid TCC.db schema plus extra tables to satisfy the app (sqlite smuggling), overwrite the app's cache DB with it, then use the copy to overwrite TCC.db.
**How found:** While analyzing Full Disk Access entitled applications, the researcher noticed the ominous environment variable SQLITE_SQLLOG_DIR. Knowing that logging to attacker-controlled directories can be dangerous, they investigated libsqlite's debug functionality and discovered it writes full DB copies with predictable filenames, following symlinks.
**Exploitation:** Attacker sets SQLITE_SQLLOG_DIR to a controlled directory, triggers a privileged app (e.g., Music) to open a database, causing libsqlite to write a full copy of the DB to a predictable filename. By symlinking that file to TCC.db and re-triggering, the attacker overwrites TCC.db with a crafted database that includes a valid TCC schema smuggled inside a legitimate app cache DB, granting full TCC access.
**Escalation:** Chained infoleak (leak any sqlite DB) with file overwrite to achieve TCC bypass, escalating from information disclosure to full access to TCC-protected resources (contacts, location, microphone, etc.).
**Insight:** Look for debug or logging environment variables in privileged applications that write to attacker-controlled paths; predictable filenames and symlink following can turn an infoleak into arbitrary file overwrite. Also, when overwriting a structured file like a database, smuggle the target schema inside a legitimate file to avoid corruption.