CVE-2024-54560
📋 TL;DR
This vulnerability allows a malicious app to modify other applications without proper App Management permission on Apple devices. It affects iOS, iPadOS, watchOS, tvOS, and macOS systems running versions before the security updates. The issue stems from a logic flaw that was addressed with improved permission checks.
💻 Affected Systems
- iOS
- iPadOS
- watchOS
- tvOS
- macOS
📦 What is this software?
Ipados by Apple
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Tvos by Apple
Watchos by Apple
⚠️ Risk & Real-World Impact
Worst Case
A malicious app could modify legitimate applications to inject malicious code, steal sensitive data, or create persistent backdoors without user knowledge.
Likely Case
Malicious apps could tamper with other apps' data or configurations, potentially leading to data corruption, privacy violations, or unauthorized functionality changes.
If Mitigated
With proper app vetting and security controls, the risk is limited to untrusted apps that manage to bypass app store review processes.
🎯 Exploit Status
Exploitation requires a malicious app to be installed and executed on the target device. The app must bypass app store review or come from untrusted sources.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: iOS 18, iPadOS 18, watchOS 11, tvOS 18, macOS Sequoia 15
Vendor Advisory: https://support.apple.com/en-us/121238
Restart Required: Yes
Instructions:
1. Open Settings app. 2. Go to General > Software Update. 3. Download and install the latest available update. 4. Restart device when prompted.
🔧 Temporary Workarounds
Restrict App Installation Sources
allConfigure devices to only allow app installation from trusted sources like the official App Store or enterprise app distribution.
Mobile Device Management (MDM) Restrictions
allUse MDM policies to restrict app installation and enforce app allowlisting.
🧯 If You Can't Patch
- Implement strict app vetting processes and only allow installation from trusted sources
- Use application allowlisting to prevent unauthorized apps from running
🔍 How to Verify
Check if Vulnerable:
Check device version in Settings > General > About > Software Version. If version is below iOS 18, iPadOS 18, watchOS 11, tvOS 18, or macOS Sequoia 15, the device is vulnerable.Check Version:
iOS/iPadOS: Settings > General > About > Software Version. macOS: Apple menu > About This Mac > macOS version.Verify Fix Applied:
Verify device is running iOS 18, iPadOS 18, watchOS 11, tvOS 18, or macOS Sequoia 15 or later.📡 Detection & Monitoring
Log Indicators:
- Unexpected app modification events
- App permission escalation attempts
- App integrity violations
Network Indicators:
- Unusual app update traffic from non-App Store sources
SIEM Query:
source="apple_device_logs" AND (event_type="app_modification" OR permission="AppManagement") AND result="success"