CVE-2024-23284

What it actually does

A logic flaw in state management allows malicious web content to bypass enforcement of Content Security Policy, resulting in unauthorized resource loading or script execution.

Why it matters to the business

Attackers can circumvent website security controls, increasing risk of data theft or unauthorized actions in browser-based applications; the large number of affected Apple platforms and downstream dependents raises exposure across user devices and enterprise environments.

How an attack unfolds

An attacker hosts or injects malicious web content that exploits the state management issue; when a victim processes the content in an affected browser, the Content Security Policy fails to enforce, permitting scripts or resources that should be blocked.

How to fix it

Update affected products to the fixed versions listed: gnutls/gnutls (GIT) to commit 0445a3554997687e10655fd10b94d5ea16adbd5a or later; apply the corresponding Apple OS updates (Safari 17.4, iOS 16.7.6, iPadOS 16.7.6, iOS 17.4, iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4) where applicable.

How to confirm the fix worked

Verify the installed version matches or exceeds the fixed commit or OS release; test with crafted test pages that previously bypassed CSP to confirm enforcement now occurs.

Typical attack path

1. Craft malicious web content designed to trigger the state management flaw
2. Host or deliver the content via phishing, compromised site, or ad network
3. Victim browser processes the content and the policy enforcement fails
4. Attacker executes unauthorized scripts or loads restricted resources

How to detect it

Review web proxy, browser, and endpoint logs for access to unexpected domains or scripts from sites that should have been blocked by CSP; correlate with threat actor patterns associated with WebKit exploitation.

What your security team should do

• Prioritize patching browsers and OS versions on all managed devices within standard update cycles
• Monitor threat actor activity around WebKit and Apple platform vulnerabilities for targeted campaigns
• Review web application CSP configurations for defense-in-depth even after patching