CVE-2024-44255
📋 TL;DR
This vulnerability allows a malicious app to execute arbitrary shortcuts without user consent on Apple devices. It affects multiple Apple operating systems including iOS, iPadOS, macOS, visionOS, watchOS, and tvOS. The issue stems from improper path handling that can be exploited to bypass security controls.
💻 Affected Systems
- iOS
- iPadOS
- macOS
- visionOS
- watchOS
- tvOS
📦 What is this software?
Ipados by Apple
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Tvos by Apple
Watchos by Apple
⚠️ Risk & Real-World Impact
Worst Case
An attacker could execute arbitrary shortcuts with system-level privileges, potentially leading to data theft, device takeover, or installation of persistent malware.
Likely Case
Malicious apps could execute unauthorized shortcuts to access sensitive data, modify system settings, or perform actions without user knowledge.
If Mitigated
With proper app vetting and security controls, the risk is limited to untrusted apps that manage to bypass App Store review processes.
🎯 Exploit Status
Exploitation requires a malicious app to be installed on the target device. The app must be able to trigger the path handling issue to execute shortcuts without consent.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: visionOS 2.1, iOS 18.1, iPadOS 18.1, macOS Ventura 13.7.1, macOS Sonoma 14.7.1, watchOS 11.1, tvOS 18.1
Vendor Advisory: https://support.apple.com/en-us/121563
Restart Required: Yes
Instructions:
1. Open Settings app. 2. Navigate to General > Software Update. 3. Download and install the latest available update for your device. 4. Restart the device after installation completes.
🔧 Temporary Workarounds
Restrict App Installation
allLimit app installation to only trusted sources and disable sideloading capabilities.
Review Shortcut Permissions
allAudit and restrict shortcut permissions for installed apps through device management policies.
🧯 If You Can't Patch
- Implement mobile device management (MDM) policies to restrict app installation and shortcut execution
- Monitor for unusual shortcut execution patterns and review app permissions regularly
🔍 How to Verify
Check if Vulnerable:
Check the device's operating system version against the affected versions listed in the Apple advisory.Check Version:
On iOS/iPadOS: Settings > General > About > Version. On macOS: Apple menu > About This Mac > macOS version.Verify Fix Applied:
Verify the device is running one of the patched versions: visionOS 2.1+, iOS 18.1+, iPadOS 18.1+, macOS Ventura 13.7.1+, macOS Sonoma 14.7.1+, watchOS 11.1+, or tvOS 18.1+.📡 Detection & Monitoring
Log Indicators:
- Unexpected shortcut execution events
- Apps attempting to execute shortcuts without user interaction
- Shortcut execution from untrusted apps
Network Indicators:
- Unusual network activity following shortcut execution
- Data exfiltration patterns after shortcut triggers
SIEM Query:
Search for events where app_id NOT IN (trusted_apps) AND action = 'shortcut_execution' AND user_interaction = false🔗 References
- https://support.apple.com/en-us/121563
- https://support.apple.com/en-us/121565
- https://support.apple.com/en-us/121566
- https://support.apple.com/en-us/121568
- https://support.apple.com/en-us/121569
- https://support.apple.com/en-us/121570
- http://seclists.org/fulldisclosure/2024/Oct/11
- http://seclists.org/fulldisclosure/2024/Oct/12
- http://seclists.org/fulldisclosure/2024/Oct/13
- http://seclists.org/fulldisclosure/2024/Oct/15
- http://seclists.org/fulldisclosure/2024/Oct/16
- http://seclists.org/fulldisclosure/2024/Oct/9
