CVE-2024-40835

What is the vulnerability?

CVE-2024-40835 is a logic issue in the Shortcuts app that could allow a shortcut to use sensitive data with certain actions without prompting the user for permission. The root cause is an insufficient check in the permission workflow, allowing sensitive data access to bypass the expected user consent dialog. Apple addressed the issue by improving checks in the affected logic [1][2].

How is it exploited?

Exploitation requires the user to run a maliciously crafted shortcut, either downloaded or received. The vulnerability resides in the way certain actions request access to sensitive data (e.g., contacts, location, or photos); the shortcut can proceed without the usual prompt, effectively bypassing user consent. No additional authentication or special network position is required beyond the user executing the shortcut [1][2].

Impact

An attacker who can convince a user to run a malicious shortcut can access sensitive data without the user's knowledge or consent. The impact is data confidentiality breach, potentially exposing private information stored on the device. Apple's advisory rates this as Medium severity with a CVSS v3 base score of 5.5 [1][2].

Mitigation

Apple has released fixes in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6, macOS Ventura 13.6.8, macOS Sonoma 14.6, and watchOS 10.6 [1][2][4]. Users should update to the latest available versions to remediate the issue.