CVE-2021-1789
Apple Multiple Products Type Confusion Vulnerability
Description
CVE-2021-1789 is a type confusion vulnerability affecting multiple Apple products, including Safari, iOS, iPadOS, macOS, watchOS, and tvOS. This security flaw allows an attacker to achieve arbitrary code execution by convincing a user to visit a website hosting maliciously crafted web content. The type confusion issue occurs in the WebKit browser engine, where processing specially crafted content leads to incorrect type handling and potential memory corruption. CISA has added CVE-2021-1789 to its Known Exploited Vulnerabilities catalog, mandating remediation by May 25, 2022. With an EPSS percentile of approximately 47%, the vulnerability represents a moderate but real exploitation risk for unpatched Apple devices.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 14.4 |
| apple | iphone os | < 14.4 |
| apple | mac os x | >= 10.14, < 10.14.6; >= 10.15, < 10.15.7; 10.14.6; 10.15.7 |
| apple | macos | >= 11.0, < 11.2 |
| apple | tvos | < 14.4 |
| apple | watchos | < 7.3 |
| fedoraproject | fedora | 32; 33 |
| webkitgtk | webkitgtk | < 2.30.6 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN6ZOD62CTO54CHTMJTHVEF6R2Y532TJ/(Broken Link, Mailing List)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU/(Broken Link, Mailing List)
- https://security.gentoo.org/glsa/202104-03(Third Party Advisory)
- https://support.apple.com/en-us/HT212146(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT212147(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT212148(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT212149(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT212152(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1789(US Government Resource)
Weakness Type
Type Confusion
The type confusion vulnerability in Apple WebKit occurs when the browser engine processes an object using a type incompatible with its actual allocated type. In the context of CVE-2021-1789, crafted web content triggers incorrect type handling in WebKit, leading to memory corruption and enabling arbitrary code execution within the browser context.
Learn more: CWE-843 — Access of Resource Using Incompatible Type (Type Confusion)
Impact Analysis
CVE-2021-1789 affects a wide range of Apple products that rely on the WebKit engine for web content rendering. The vulnerability is remotely exploitable through the network by serving malicious web content, though it requires user interaction in the form of visiting a compromised or attacker-controlled website. No authentication is needed for the attacker to deliver the exploit payload. Successful exploitation grants the attacker arbitrary code execution, which can compromise the confidentiality of sensitive data stored on the device, the integrity of the operating system and installed applications, and the availability of the affected device. The EPSS percentile of approximately 47% indicates a moderate probability of exploitation, and CISA's inclusion of CVE-2021-1789 in the KEV catalog confirms that real-world attacks leveraging this vulnerability have been observed.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-1789 in the wild by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of May 25, 2022. The EPSS percentile of approximately 47% suggests moderate exploitation activity, indicating the vulnerability is being used in targeted attacks rather than in mass exploitation campaigns. No specific public proof-of-concept exploit code has been identified in the available references, but confirmed in-the-wild exploitation means threat actors possess working exploits for this Apple WebKit type confusion flaw.
Remediation
-
Apply Apple security updates immediately as directed by CISA's required action: "Apply updates per vendor instructions." Update all affected Apple products including Safari, iOS, iPadOS, macOS, watchOS, and tvOS to the latest versions that contain the WebKit type confusion fix.
-
Enable automatic updates on all Apple devices to ensure future WebKit security patches are applied promptly. Verify update status across all managed Apple devices in your environment through MDM solutions or manual checks.
-
Implement web content filtering as an interim mitigation to block access to known malicious websites and reduce the attack surface for WebKit-based exploitation. Deploy DNS filtering and web proxy solutions to restrict access to untrusted or suspicious domains.
-
Monitor endpoints for indicators of compromise by reviewing device logs for unusual browser process behavior, unexpected application crashes in Safari or WebKit-based apps, and signs of unauthorized code execution or data exfiltration following web browsing activity.
-
Deploy browser isolation technology for high-risk users and environments to contain potential WebKit exploitation within an isolated context, preventing attackers from leveraging browser vulnerabilities to access the underlying operating system and device data.
Technical Details
CVE-2021-1789 is a type confusion vulnerability in Apple's WebKit browser engine, which is the rendering engine used by Safari and all iOS/iPadOS browsers. Type confusion occurs when WebKit allocates or accesses a JavaScript object using one type but subsequently operates on it as a different, incompatible type, resulting in incorrect memory layout assumptions and potential memory corruption. An attacker can trigger this vulnerability remotely by hosting specially crafted web content that causes WebKit to mishandle type information during JavaScript execution. Once the type confusion is triggered, the resulting memory corruption can be leveraged to achieve arbitrary read/write primitives in the browser process, ultimately enabling arbitrary code execution on the victim's device when they simply navigate to the malicious web page.
Frequently Asked Questions
Is CVE-2021-1789 being actively exploited?
Yes, CVE-2021-1789 is being actively exploited in the wild. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of May 25, 2022. The EPSS percentile of approximately 47% indicates moderate exploitation activity targeting unpatched Apple devices.
What products are affected by CVE-2021-1789?
CVE-2021-1789 affects multiple Apple products that use the WebKit browser engine, including Safari, iOS, iPadOS, macOS, watchOS, and tvOS. Any application on these platforms that renders web content through WebKit is potentially vulnerable.
How do I fix CVE-2021-1789?
Apply the latest security updates from Apple for all affected products including Safari, iOS, iPadOS, macOS, watchOS, and tvOS. Enable automatic updates on all Apple devices and use web content filtering to reduce exposure to malicious websites as an interim measure.
How severe is CVE-2021-1789?
CVE-2021-1789 is a serious vulnerability that enables arbitrary code execution through malicious web content. With an EPSS percentile of approximately 47% and confirmed active exploitation in the KEV catalog, organizations should prioritize patching this WebKit type confusion flaw across all Apple devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.