CVE-2023-41074 – This vulnerability allows arbitrary code execut... (How to Fix)

Q: What is the severity of CVE-2023-41074?

CVE-2023-41074 has a CVSS score of 8.8 (HIGH). This vulnerability allows arbitrary code execution when processing malicious web content in Apple's WebKit browser engine. It affects users of Safari and Apple operating systems before the 2023 updates. Attackers could exploit this by tricking users into visiting specially crafted websites.

📋 TL;DR

This vulnerability allows arbitrary code execution when processing malicious web content in Apple's WebKit browser engine. It affects users of Safari and Apple operating systems before the 2023 updates. Attackers could exploit this by tricking users into visiting specially crafted websites.

💻 Affected Systems

Products:

Safari
tvOS
watchOS
iOS
iPadOS
macOS

Versions: Versions before tvOS 17, Safari 17, watchOS 10, iOS 17, iPadOS 17, macOS Sonoma 14

Operating Systems: iOS, iPadOS, macOS, tvOS, watchOS

Default Config Vulnerable: ⚠️ Yes

Notes: All default configurations of affected Apple devices with web browsing capabilities are vulnerable.

📦 What is this software?

Macos by Apple

macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...

Learn more about Macos →

Safari by Apple

View all CVEs affecting Safari →

Tvos by Apple

View all CVEs affecting Tvos →

Watchos by Apple

View all CVEs affecting Watchos →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise allowing attackers to install malware, steal data, or create persistent backdoors on affected devices.

🟠

Likely Case

Drive-by attacks where visiting a malicious website leads to malware installation or credential theft without user interaction.

🟢

If Mitigated

Limited impact with proper network segmentation, web filtering, and endpoint protection that blocks malicious sites.

🌐 Internet-Facing: HIGH - Web browsers process untrusted internet content by design, making this easily exploitable via malicious websites.

🏢 Internal Only: MEDIUM - Internal web applications could be weaponized, but requires user interaction with malicious content.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires user to visit malicious website but no authentication or special permissions needed. Multiple public disclosures suggest active exploitation knowledge.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: tvOS 17, Safari 17, watchOS 10, iOS 17, iPadOS 17, macOS Sonoma 14

Vendor Advisory: https://support.apple.com/en-us/HT213941

Restart Required: Yes

Instructions:

1. Open Settings/System Preferences 2. Go to Software Update 3. Install available updates 4. Restart device when prompted

🔧 Temporary Workarounds

Disable JavaScript

macos

Temporarily disable JavaScript in Safari to prevent exploitation

Safari > Preferences > Security > Uncheck 'Enable JavaScript'

Use alternative browser

all

Switch to non-WebKit based browsers until patched

🧯 If You Can't Patch

Implement strict web filtering to block known malicious sites
Deploy endpoint detection and response (EDR) to monitor for exploitation attempts

🔍 How to Verify

Check if Vulnerable:

Check current OS version against affected versions list

Check Version:

macOS: sw_vers -productVersion, iOS/iPadOS: Settings > General > About > Version

Verify Fix Applied:

Verify OS version matches or exceeds patched versions

📡 Detection & Monitoring

Log Indicators:

Unusual Safari/WebKit process crashes
Suspicious network connections from browser processes

Network Indicators:

Connections to known malicious domains from Apple devices
Unusual outbound traffic patterns from browsers

SIEM Query:

process_name:"Safari" OR process_name:"WebKit" AND (event_type:crash OR suspicious_network_activity)

📊 Metadata

CVE ID: CVE-2023-41074

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Published: September 27, 2023

Last Updated: November 21, 2024

🔗 References

http://seclists.org/fulldisclosure/2023/Oct/10 Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2023/Oct/2 Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2023/Oct/3 Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2023/Oct/8 Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2023/Oct/9 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/28/3 Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EEMDC5TQAANFH5D77QM34ZTUKXPFGVL/ Mailing List,Third Party Advisory
https://security.gentoo.org/glsa/202401-33
https://support.apple.com/en-us/HT213936 Release Notes,Vendor Advisory
https://support.apple.com/en-us/HT213937 Release Notes,Vendor Advisory
https://support.apple.com/en-us/HT213938 Release Notes,Vendor Advisory
https://support.apple.com/en-us/HT213940 Release Notes,Vendor Advisory
https://support.apple.com/en-us/HT213941 Release Notes,Vendor Advisory
https://www.debian.org/security/2023/dsa-5527 Third Party Advisory
http://seclists.org/fulldisclosure/2023/Oct/10 Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2023/Oct/2 Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2023/Oct/3 Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2023/Oct/8 Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2023/Oct/9 Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/09/28/3 Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EEMDC5TQAANFH5D77QM34ZTUKXPFGVL/ Mailing List,Third Party Advisory
https://security.gentoo.org/glsa/202401-33
https://support.apple.com/en-us/HT213936 Release Notes,Vendor Advisory
https://support.apple.com/en-us/HT213937 Release Notes,Vendor Advisory
https://support.apple.com/en-us/HT213938 Release Notes,Vendor Advisory
https://support.apple.com/en-us/HT213940 Release Notes,Vendor Advisory
https://support.apple.com/en-us/HT213941 Release Notes,Vendor Advisory
https://webkitgtk.org/security/WSA-2023-0009.html
https://www.debian.org/security/2023/dsa-5527 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON