CVE-2024-40787

Vulnerability

CVE-2024-40787 is a security issue in Apple's Shortcuts app that allows a shortcut to bypass Internet permission requirements. The root cause is insufficient user consent prompting, which the vendor addressed by adding an additional prompt for user consent [1].

Exploitation

To exploit this vulnerability, an attacker would need to create a malicious shortcut that attempts to access the Internet without proper authorization. The attack vector is local, requiring the user to run the shortcut, but no special privileges beyond Shortcuts execution are needed. User interaction is required to initiate the shortcut [4].

Impact

Successful exploitation could allow a shortcut to access the Internet without the user's explicit permission, potentially leading to unauthorized data transmission or exposure of private information. The impact is limited to Internet access bypass, not full system compromise.

Mitigation

Apple has fixed this issue in iOS 17.6, iPadOS 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, and watchOS 10.6. Users should update their devices to the latest versions to protect against this vulnerability [1][4].