CVE-2023-23518

What it actually does

Memory corruption vulnerability in WebKit allows processing of malicious web content to trigger arbitrary code execution with the privileges of the affected process.

Why it matters to the business

Unpatched Apple devices across macOS, iOS, iPadOS, watchOS, tvOS and Safari can be compromised when users visit attacker-controlled websites, enabling data theft, persistent access or further lateral movement with no user interaction beyond loading a page.

How an attack unfolds

An attacker hosts a webpage containing specially crafted content that triggers a type confusion or memory handling flaw in WebKit; when a victim loads the page in an affected browser or app, the flaw is triggered, leading to arbitrary code execution. Named threat actors have been associated with targeting Apple WebKit products.

How to fix it

Update affected devices to the fixed releases: macOS Monterey 12.6.3, macOS Ventura 13.2, macOS Big Sur 11.7.3, Safari 16.3, iOS 16.3, iPadOS 16.3, watchOS 9.3 and tvOS 16.3. Enable automatic updates where possible and remove unsupported older versions from the environment.

How to confirm the fix worked

Verify installed versions against the listed fixed releases on each platform; confirm WebKit and Safari processes are running the updated builds and test that known malicious proof-of-concept pages no longer trigger code execution.

Typical attack path

1. Attacker crafts malicious web content exploiting the memory handling flaw
2. Victim is enticed to visit the page via phishing, compromised site or drive-by
3. WebKit processes the content and the flaw is triggered
4. Arbitrary code executes with the privileges of the browser or app process
5. Attacker establishes persistence, exfiltrates data or installs additional payloads

How to detect it

Inspect web proxy, browser and system logs for visits to suspicious domains followed by unexpected WebKit crashes or new processes; correlate with endpoint telemetry for post-exploitation behavior such as unusual network connections or file writes.

What your security team should do

• Prioritize patching all Apple endpoints and browsers to the versions listed in remediation guidance
• Monitor EPSS and threat actor activity for any increase in exploitation attempts
• Enforce application allow-listing and browser sandboxing policies to limit impact of successful exploitation
• Review logs for unexpected WebKit or Safari process crashes or new child processes