CVE-2020-24003: 
Homebrew vulnerability analysis and mitigation

Microsoft Skype through version 8.59.0.77 on macOS contains a security vulnerability related to the disable-library-validation entitlement. This vulnerability was discovered on April 10, 2020, and allows a local process with user privileges to gain unprompted access to the microphone and camera by loading a crafted library that inherits Skype Client's device permissions (HDW Blog).

The vulnerability exists due to Skype having the 'com.apple.security.cs.disable-library-validation' entitlement while also possessing camera and microphone access permissions. Although Skype is compiled with Hardened Runtime protection, the disable-library-validation entitlement allows bypassing these restrictions. The vulnerability enables loading of unsigned shared libraries, which can then inherit Skype's device permissions. The CVSS v3.1 base score is 3.3 (LOW) with the vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability allows a local attacker to bypass macOS security controls and gain unauthorized access to the camera and microphone through Skype. This could be exploited to silently record video conferences or use Skype as a proxy to record video and sound, provided the user has previously granted Skype permission to access these devices (HDW Blog).

The vulnerability can be exploited by a local attacker by developing a shared library that proxifies the Electron Framework library used by Skype. The exploit requires the attacker to have local access to the machine and the ability to modify files in the Skype application directory (HDW Blog).

Microsoft addressed this vulnerability after being contacted on April 14, 2020, with a fix being integrated on May 18, 2020. Users should update their Skype installation to a version newer than 8.59.0.77 (HDW Blog).