CVE-2024-23271

What it actually does

The flaw is a logic error in WebKit's cross-origin checks that permits a malicious website to trigger unauthorized cross-origin actions, violating same-origin policy expectations and allowing integrity-impacting operations without user consent.

Why it matters to the business

Attackers can modify user data or perform actions across websites through a crafted malicious page, leading to unauthorized changes, potential account compromise, and loss of trust in web applications on affected Apple devices.

How an attack unfolds

An attacker hosts a malicious website that loads in Safari or other WebKit-based browsers on iOS, iPadOS, macOS, tvOS or watchOS. The page triggers the flawed cross-origin logic path, resulting in unexpected behavior that bypasses intended origin restrictions and allows integrity modifications.

How to fix it

Update to Safari 17.3 or later, iOS 17.3 / iPadOS 17.3 or later, macOS Sonoma 14.3 or later, tvOS 17.3 or later, and watchOS 10.3 or later. Apply all available Apple security updates promptly across managed devices.

How to confirm the fix worked

Verify that devices are running the fixed OS and browser versions listed in the advisory. Confirm that WebKit-based browsers reject cross-origin requests that previously triggered the logic flaw.

Typical attack path

1. Attacker crafts and hosts a malicious website targeting the WebKit cross-origin handling logic.
2. Victim is tricked into visiting the site via phishing or other social engineering.
3. The site loads and exercises the vulnerable code path in the browser.
4. Unexpected cross-origin actions are performed, resulting in unauthorized integrity changes.

How to detect it

Review browser history and logs for visits to suspicious domains around the time of suspected incidents; inspect network traffic for unexpected cross-origin requests originating from WebKit processes.

What your security team should do

• Prioritize patching all affected Apple devices to the versions containing the fix.
• Enforce automatic update policies for Safari, iOS, iPadOS, macOS, tvOS and watchOS.
• Monitor for any reports of cross-origin anomalies in internal web applications accessed from Apple devices.