CVE-2024-23263

What it actually does

A logic issue in input validation allows maliciously crafted web content to bypass enforcement of Content Security Policy, enabling unauthorized script execution or resource loading.

Why it matters to the business

Organizations face increased risk of web-based attacks that can lead to data exfiltration, unauthorized actions on user sessions, or compromise of web application integrity, especially in environments with high web content processing volume.

How an attack unfolds

An attacker creates specially crafted web content designed to exploit the validation flaw; when processed by affected clients, the Content Security Policy is not enforced, allowing scripts or resources that should be blocked to execute or load, potentially facilitating further attacks such as those associated with spyware campaigns.

How to fix it

Update affected products to the fixed versions provided, including Safari 17.4, iOS 16.7.6, iPadOS 16.7.6, iOS 17.4, iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4, or the specific GnuTLS GIT commit 0445a3554997687e10655fd10b94d5ea16adbd5a where applicable.

How to confirm the fix worked

Verify deployment of the listed fixed versions across environments and test web content handling to confirm Content Security Policy rules are enforced as expected.

Typical attack path

1. Craft malicious web content targeting the validation weakness
2. Deliver content through phishing, compromised sites, or embedded resources
3. Victim processes the content in an affected browser or application
4. Content Security Policy enforcement is bypassed
5. Attacker executes unauthorized scripts or loads blocked resources

How to detect it

Review web server and browser logs for unexpected script loads or policy violations from untrusted sources; correlate with threat actor patterns associated with Apple WebKit exploitation.

What your security team should do

• Prioritize patching all affected clients and browsers immediately given the public disclosure and listed threat actor interest
• Review and strengthen Content Security Policy configurations in web applications
• Monitor for unusual script execution or policy bypass indicators in web traffic logs