CVE-2025-30433
📋 TL;DR
This vulnerability allows malicious shortcuts in Apple's Shortcuts app to bypass file access restrictions and read sensitive files that should be inaccessible. It affects users of visionOS, macOS, iOS, and iPadOS who have not updated to the patched versions. Attackers could exploit this to steal confidential data from compromised devices.
💻 Affected Systems
- visionOS
- macOS
- iOS
- iPadOS
📦 What is this software?
Ipados by Apple
Ipados by Apple
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →⚠️ Risk & Real-World Impact
Worst Case
An attacker could create a malicious shortcut that exfiltrates sensitive files (passwords, documents, credentials) from the device, leading to complete data compromise and potential identity theft.
Likely Case
Malicious shortcuts distributed through social engineering or compromised sources could access user documents, photos, or app data that should be protected by sandboxing.
If Mitigated
With proper app sandboxing and user permission controls, only files explicitly granted to the Shortcuts app would be accessible, limiting data exposure.
🎯 Exploit Status
Exploitation requires user interaction to install/run a malicious shortcut. No public exploit code has been disclosed as of the advisory date.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: visionOS 2.4, macOS Ventura 13.7.5, iOS 18.4, iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5
Vendor Advisory: https://support.apple.com/en-us/122371
Restart Required: Yes
Instructions:
1. Open Settings > General > Software Update on iOS/iPadOS/visionOS or System Settings > General > Software Update on macOS. 2. Download and install the available update. 3. Restart the device when prompted.
🔧 Temporary Workarounds
Disable Shortcuts App
allTemporarily disable or restrict the Shortcuts app to prevent exploitation until patching is possible.
Restrict Shortcut Installation
allConfigure device policies to only allow trusted shortcuts and prevent installation from untrusted sources.
🧯 If You Can't Patch
- Implement mobile device management (MDM) policies to restrict shortcut installation and execution.
- Educate users to only install shortcuts from trusted sources and avoid unknown or suspicious shortcuts.
🔍 How to Verify
Check if Vulnerable:
Check the device's operating system version against the patched versions listed in the advisory.Check Version:
iOS/iPadOS/visionOS: Settings > General > About > Software Version. macOS: Apple menu > About This Mac > macOS version.Verify Fix Applied:
Confirm the device is running one of the patched versions: visionOS 2.4+, macOS Ventura 13.7.5+, iOS 18.4+, iPadOS 18.4+, iPadOS 17.7.6+, macOS Sequoia 15.4+, or macOS Sonoma 14.7.5+.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns by the Shortcuts app
- Shortcuts accessing files outside their expected sandbox
Network Indicators:
- Unexpected data exfiltration from devices running vulnerable versions
SIEM Query:
Search for Shortcuts app process accessing sensitive file paths or unusual file I/O patterns on Apple devices.🔗 References
- https://support.apple.com/en-us/122371
- https://support.apple.com/en-us/122372
- https://support.apple.com/en-us/122373
- https://support.apple.com/en-us/122374
- https://support.apple.com/en-us/122375
- https://support.apple.com/en-us/122378
- http://seclists.org/fulldisclosure/2025/Apr/10
- http://seclists.org/fulldisclosure/2025/Apr/12
- http://seclists.org/fulldisclosure/2025/Apr/13
- http://seclists.org/fulldisclosure/2025/Apr/4
- http://seclists.org/fulldisclosure/2025/Apr/5
- http://seclists.org/fulldisclosure/2025/Apr/8
- http://seclists.org/fulldisclosure/2025/Apr/9
