CVE-2021-1879
Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability
Description
CVE-2021-1879 is a medium-severity cross-site scripting (XSS) vulnerability in Apple WebKit affecting iOS, iPadOS, and watchOS. The flaw allows processing of maliciously crafted web content to lead to universal cross-site scripting, enabling an attacker to execute scripts across different origins. CISA has added CVE-2021-1879 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. With an EPSS score of 1.50% (80.9th percentile), this WebKit vulnerability has been used in targeted attacks to steal authentication data.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 14.4.2 |
| apple | iphone os | < 12.5.2; >= 13.0, < 14.4.2 |
| apple | watchos | < 7.3.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://support.apple.com/en-us/HT212256(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT212257(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT212258(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1879(US Government Resource)
Weakness Type
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting occurs when software fails to properly neutralize user-controllable input before placing it in web page output. In CVE-2021-1879, a flaw in WebKit's management of object lifetimes enables universal cross-site scripting, allowing malicious web content to execute scripts across different security origins, bypassing the same-origin policy that normally isolates websites from each other.
Learn more: CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Impact Analysis
CVE-2021-1879 carries a CVSS 3.1 score of 6.1 (MEDIUM), but its real-world impact is amplified by confirmed active exploitation. The vulnerability is remotely exploitable over the network with low attack complexity and requires no authentication, though user interaction is needed. The scope is changed, meaning the exploitation can affect resources beyond the vulnerable WebKit component itself. While the direct impact on confidentiality and integrity is low and there is no availability impact, universal XSS allows an attacker to steal session cookies, capture credentials, and perform actions on behalf of users across any web origin, making it a powerful tool for targeted espionage operations.
Exploit Maturity
CVE-2021-1879 is confirmed as actively exploited through its inclusion in the CISA Known Exploited Vulnerabilities catalog. Apple has acknowledged reports that this issue may have been actively exploited in the wild. The EPSS score of 1.50% (80.9th percentile) indicates a notable probability of exploitation. No public exploit code was identified in the available references, but the confirmed active exploitation status indicates that sophisticated threat actors have developed and deployed exploits targeting this WebKit universal XSS flaw. Federal agencies were required to remediate by 2021-11-17 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Update to iOS 14.4.2/iPadOS 14.4.2, iOS 12.5.2, or watchOS 7.3.3.
- For devices running older iOS versions limited to the iOS 12 branch, ensure iOS 12.5.2 is installed. For iPadOS, update to at least 14.4.2. For Apple Watch, update watchOS to 7.3.3.
- Implement Content Security Policy (CSP) headers on web applications accessed by users to reduce the impact of potential universal XSS exploitation, as CSP can restrict script execution even if the browser vulnerability is present.
- Monitor authentication logs for suspicious cross-origin activity, unexpected session creation, or credential usage patterns that may indicate exploitation of this universal XSS vulnerability.
- Enable enhanced tracking prevention and restrict JavaScript execution from untrusted sources through web content filtering to provide additional defense layers against cross-site scripting attacks.
Technical Details
CVE-2021-1879 is a universal cross-site scripting vulnerability in Apple's WebKit engine caused by improper management of object lifetimes. According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), the vulnerability is network-accessible with low complexity and requires no privileges but needs user interaction. The scope is changed, indicating cross-origin impact. The flaw allows malicious web content to escape the same-origin policy sandbox, enabling script execution in the security context of arbitrary web origins. This type of universal XSS is particularly dangerous as it can target any website the victim visits, allowing attackers to steal credentials and session tokens from high-value targets. Apple addressed this issue with improved management of object lifetimes.
Frequently Asked Questions
Is CVE-2021-1879 being actively exploited?
Yes. CVE-2021-1879 is listed in the CISA Known Exploited Vulnerabilities catalog, and Apple has acknowledged reports of active exploitation. The EPSS score of 1.50% (80.9th percentile) confirms a notable exploitation probability.
What products are affected by CVE-2021-1879?
CVE-2021-1879 affects Apple iPadOS (< 14.4.2), iPhone OS (< 12.5.2; >= 13.0, < 14.4.2), and watchOS (< 7.3.3). Any application using WebKit for HTML rendering on these platforms is affected.
How do I fix CVE-2021-1879?
Apply updates per vendor instructions. Update to iOS 14.4.2, iPadOS 14.4.2, iOS 12.5.2, or watchOS 7.3.3. Additionally, implement Content Security Policy headers on web applications to mitigate the impact of potential XSS exploitation.
How severe is CVE-2021-1879?
CVE-2021-1879 has a CVSS 3.1 score of 6.1 (MEDIUM), but its severity is elevated by confirmed active exploitation. The universal XSS capability allows attackers to steal credentials and perform actions across any web origin, making it a powerful tool for targeted attacks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.