CVE-2024-40809

Vulnerability

Overview

CVE-2024-40809 is a logic issue in the Shortcuts app on Apple platforms. The flaw allows a shortcut to bypass Internet permission requirements, meaning a malicious shortcut could access the network without the user's explicit consent. The issue was addressed with improved checks in the affected operating systems.

Exploitation

To exploit this vulnerability, an attacker would need to convince a user to run a crafted shortcut. No additional privileges or network position are required beyond the ability to execute a shortcut. The logic flaw circumvents the permission prompt that normally asks the user to grant Internet access, enabling the shortcut to make network requests silently.

Impact

A successful exploit could allow an attacker to exfiltrate sensitive data, communicate with command-and-control servers, or perform other unauthorized network operations. This could lead to privacy breaches or further compromise of the device.

Mitigation

Apple has released patches for iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6, macOS Ventura 13.6.8, macOS Sonoma 14.6, visionOS 1.3, and watchOS 10.6. Users should update their devices to the latest available versions to mitigate the risk. The fix is included in the security content of macOS Sonoma 14.6 [1].