CVE-2023-23526

Vulnerability

A logic flaw in Gatekeeper's handling of files downloaded from an iCloud shared-by-me folder allowed such files to bypass code signing and notarization checks. This affected systems running prior to macOS Ventura 13.3, iOS 16.4, and iPadOS 16.4 [1][2].

Exploitation

An attacker with access to a victim’s iCloud shared-by-me folder (or able to share a folder with the victim) could place a crafted file. When the victim downloads that file, Gatekeeper would not perform its usual validation, allowing the file to be opened without warning. No additional user interaction beyond downloading and opening the file is required.

Impact

Successful exploitation allows the attacker’s file to execute malicious code on the victim’s device, bypassing Gatekeeper’s security checks. This could lead to arbitrary code execution with the victim’s user privileges, potentially compromising data confidentiality, integrity, and system availability.

Mitigation

Apple addressed the issue in macOS Ventura 13.3, iOS 16.4, and iPadOS 16.4, released on March 27, 2023 [1][2]. Users should update their devices to these or later versions. No workarounds are documented.