CVE-2023-23529
Apple Multiple Products WebKit Type Confusion Vulnerability
Description
CVE-2023-23529 is a type confusion vulnerability in Apple WebKit, the browser engine powering Safari, iOS, iPadOS, and macOS. When a user visits a maliciously crafted webpage, the type confusion flaw allows an attacker to execute arbitrary code on the victim device. This vulnerability affects Safari versions prior to 16.3, iOS and iPadOS versions prior to 15.7.4 and 16.3.1, and macOS Ventura prior to 13.2.1. Apple has acknowledged that CVE-2023-23529 may have been actively exploited, and CISA has confirmed this by adding it to its Known Exploited Vulnerabilities catalog. With a CVSS score of 8.8 (High), this WebKit type confusion vulnerability represents a serious threat to Apple device users.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | safari | < 16.3 |
| apple | ipados | < 15.7.4; >= 16.0, < 16.3.1 |
| apple | iphone os | < 15.7.4; >= 16.0, < 16.3.1 |
| apple | macos | >= 13.0, < 13.2.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/HT213633(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213635(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213638(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213673(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-23529(US Government Resource)
Weakness Type
CWE-843: Access of Resource Using Incompatible Type (Type Confusion)
Type confusion occurs when a program accesses a resource using a type that is incompatible with the actual type of that resource. In the context of CVE-2023-23529, the WebKit engine incorrectly handles JavaScript object types during processing, allowing crafted web content to trick the engine into treating one object type as another. This misinterpretation enables memory corruption that leads to arbitrary code execution.
Learn more: CWE-843 — Access of Resource Using Incompatible Type
Impact Analysis
Attack Vector (Network): CVE-2023-23529 is remotely exploitable without physical access — an attacker only needs to lure a victim to a malicious webpage or deliver crafted web content through an embedded browser view. Attack Complexity (Low): The exploitation conditions are straightforward with no special configurations or race conditions required. Privileges Required (None): No authentication or prior access to the victim device is needed. User Interaction (Required): The victim must interact by visiting a malicious webpage or clicking a link, which is the primary limiting factor. Confidentiality, Integrity, and Availability (all High): Successful exploitation enables arbitrary code execution, potentially granting the attacker access to all user data, the ability to install malware or modify system files, and the power to disrupt device functionality. The CVSS score of 8.8 (High severity) reflects the serious impact of this WebKit vulnerability. While the EPSS score of 0.045% is relatively low, Apple has confirmed that this vulnerability may have been actively exploited in targeted attacks, indicating that sophisticated threat actors have already weaponized it.
Exploit Maturity
Active exploitation of CVE-2023-23529 has been confirmed by both Apple and CISA. Apple stated in its advisory that it "is aware of a report that this issue may have been actively exploited," and CISA added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of March 7, 2023. The EPSS score of 0.045% suggests that broad, opportunistic exploitation is not widespread, which is consistent with this being a targeted zero-day attack rather than a mass exploitation campaign. No specific ransomware association has been reported. Despite the low EPSS score, the confirmed active exploitation by sophisticated actors means organizations and individuals should treat remediation as urgent.
Remediation
- Update all affected Apple devices immediately. Apply the security patches released by Apple: update iOS and iPadOS to 15.7.4 or 16.3.1, macOS Ventura to 13.2.1, and Safari to 16.3 or later. As directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable."
- Prioritize updates across all Apple platforms. Since WebKit is shared across Safari, iOS, iPadOS, and macOS, all Apple devices in your environment must be patched. Use mobile device management (MDM) solutions to enforce updates on enterprise-managed iPhones, iPads, and Macs.
- Implement web content filtering. Until all devices are patched, deploy web proxies or DNS filtering to block access to known malicious domains. Configure content security policies to restrict untrusted JavaScript execution in enterprise browsers.
- Monitor for indicators of compromise. Review device logs for unexpected WebKit crashes, unusual process spawning from Safari or WebKit-based applications, and signs of post-exploitation activity. Check Apple security advisories at HT213633, HT213635, HT213638, and HT213673 for additional details.
- Educate users about phishing risks. Since exploitation requires user interaction (visiting a malicious page), train users to avoid clicking suspicious links in emails, messages, and social media, particularly on unpatched devices.
Technical Details
Vulnerability Mechanism: CVE-2023-23529 is a type confusion vulnerability (CWE-843) in Apple WebKit, the rendering engine used by Safari and all iOS/iPadOS browsers. Type confusion occurs when the engine processes a JavaScript object as if it were a different type, leading to incorrect memory access patterns. Exploitation Path: An attacker crafts a malicious webpage containing specially constructed JavaScript that triggers the type confusion in WebKit during rendering. When the victim visits this page, the engine misinterprets the type of an in-memory object, enabling the attacker to read or write to unintended memory locations. This memory corruption is leveraged to achieve arbitrary code execution within the context of the browser process. CVSS Vector Analysis: The vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates this is a network-accessible vulnerability with low complexity and no privilege requirements, though it does require user interaction in the form of visiting the malicious page. The unchanged scope means exploitation is confined to the WebKit process, but the high impact across all three CIA dimensions reflects the severity of arbitrary code execution.
Frequently Asked Questions
Is CVE-2023-23529 being actively exploited?
Yes, CVE-2023-23529 has been actively exploited. Apple confirmed in its security advisory that it was aware of reports of active exploitation. CISA further validated this by adding the vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of March 7, 2023. No specific ransomware association has been reported.
What products are affected by CVE-2023-23529?
CVE-2023-23529 affects multiple Apple products that use the WebKit engine: Safari (versions prior to 16.3), iOS and iPadOS (versions prior to 15.7.4 and 16.3.1), and macOS Ventura (versions prior to 13.2.1). Any application on these platforms that renders web content through WebKit is potentially affected.
How do I fix CVE-2023-23529?
Update all Apple devices to the patched versions: iOS/iPadOS 15.7.4 or 16.3.1, macOS Ventura 13.2.1, and Safari 16.3 or later. Enterprise environments should use MDM solutions to enforce updates. Until patching is complete, implement web content filtering and educate users about the risks of visiting untrusted websites.
How severe is CVE-2023-23529?
CVE-2023-23529 has a CVSS score of 8.8 (High severity), reflecting its potential for remote arbitrary code execution via malicious web content. While the EPSS score is low at 0.045%, the confirmed active exploitation makes it a high-priority security issue. The vulnerability requires user interaction (visiting a malicious page), which is the primary mitigating factor.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.