CVE-2023-41993
Apple Multiple Products WebKit Code Execution Vulnerability
Description
CVE-2023-41993 is a critical web content processing vulnerability in Apple's WebKit engine that can lead to arbitrary code execution when a user visits a maliciously crafted webpage. The flaw affects a wide range of products including macOS Sonoma, iOS, iPadOS, and extends to third-party software that embeds WebKit such as WebKitGTK+, Oracle JDK/JRE, and various NetApp products. Apple has confirmed that CVE-2023-41993 may have been actively exploited in the wild against versions of iOS prior to 16.7, and CISA has listed it in its Known Exploited Vulnerabilities catalog with a remediation deadline of October 16, 2023. With a CVSS score of 8.8 (High) and an EPSS score of 21.71% placing it in the 95.62nd percentile, this WebKit vulnerability represents a high-priority security risk demanding immediate attention.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 17.0.1 |
| apple | iphone os | < 17.0.1 |
| apple | macos | < 14.0 |
| fedoraproject | fedora | 37; 38; 39 |
| debian | debian linux | 11.0; 12.0 |
| oracle | graalvm | 20.3.13; 21.3.9 |
| oracle | jdk | 1.8.0 |
| oracle | jre | 1.8.0 |
| netapp | active iq unified manager | - |
| netapp | cloud insights acquisition unit | - |
| netapp | cloud insights storage workload security agent | - |
| netapp | oncommand insight | - |
| netapp | oncommand workflow automation | - |
| webkitgtk | webkitgtk\+ | < 2.42.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://security.gentoo.org/glsa/202401-33(Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20240426-0004/(Third Party Advisory)
- https://support.apple.com/en-us/HT213940(Vendor Advisory)
- https://support.apple.com/kb/HT213926(Vendor Advisory)
- https://support.apple.com/kb/HT213930(Vendor Advisory)
- https://webkitgtk.org/security/WSA-2023-0009.html(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41993(US Government Resource)
Weakness Type
CWE-754: Improper Check for Unusual or Exceptional Conditions
CWE-754 describes software that does not properly check for unusual or exceptional conditions during processing. In CVE-2023-41993, this weakness manifests in Apple's WebKit browser engine, where improper validation of web content allows specially crafted pages to trigger unexpected code execution paths, ultimately enabling arbitrary code execution on the victim's device.
Learn more: CWE-754 — Improper Check for Unusual or Exceptional Conditions
Impact Analysis
CVE-2023-41993 carries a CVSS v3.1 score of 8.8 (High severity), reflecting a severe remote code execution risk through web content processing. Attack Vector (Network): The vulnerability is remotely exploitable without physical access — an attacker only needs to lure a victim to a malicious webpage. Attack Complexity (Low): Exploitation requires no special conditions or prior knowledge of the target environment. Privileges Required (None): No authentication or account access is needed on the target system. User Interaction (Required): The victim must visit or be redirected to a malicious webpage for the exploit to trigger. Confidentiality, Integrity, and Availability (all High): Successful exploitation enables arbitrary code execution, potentially granting the attacker complete control over the affected system, including access to sensitive data, modification of files, and denial of service. The EPSS score of 21.71% (95.62nd percentile) indicates a very high likelihood of active exploitation, and the broad range of affected products — from Apple operating systems to Oracle JDK, Fedora, Debian, and NetApp solutions — amplifies the potential impact across diverse enterprise environments.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-41993 in the wild by including it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of October 16, 2023. Apple has acknowledged that this WebKit vulnerability may have been actively exploited against iOS versions prior to 16.7, indicating targeted attacks leveraging malicious web content. The EPSS score of 21.71% (95.62nd percentile) indicates a very high probability of exploitation activity, placing this vulnerability among the most likely to be exploited. While no dedicated public exploit code or proof-of-concept was identified in the available references, the confirmed in-the-wild exploitation and the high EPSS score make CVE-2023-41993 an urgent priority for patching.
Remediation
- Apply vendor patches immediately. Update macOS to Sonoma 14 or later, and ensure iOS/iPadOS devices are updated to version 16.7 or later as specified in Apple's security advisories (HT213940, HT213926, HT213930). CISA's KEV required action states: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Update third-party WebKit consumers. Organizations using WebKitGTK+ should update to the patched version referenced in WSA-2023-0009. Update Oracle JDK/JRE, Fedora, and Debian packages that bundle WebKit. NetApp users should review NTAP-20240426-0004 and apply relevant updates to Active IQ Unified Manager, Cloud Insights, and OnCommand products.
- Implement web content filtering. Deploy web proxy or gateway solutions to block access to known malicious domains. Configure content security policies to restrict the execution of untrusted scripts in browser environments.
- Monitor for indicators of compromise. Review browser crash logs, endpoint detection alerts, and network traffic for signs of WebKit exploitation attempts. Pay particular attention to unusual JavaScript execution patterns or unexpected process spawning from browser processes.
- Enforce browser and OS update policies. Use mobile device management (MDM) and enterprise patch management tools to enforce minimum OS and browser versions across all managed endpoints, preventing use of vulnerable WebKit builds.
Technical Details
CVE-2023-41993 is classified under CWE-754 (Improper Check for Unusual or Exceptional Conditions), where Apple's WebKit engine fails to properly validate certain aspects of web content during processing, leading to a condition that allows arbitrary code execution. The vulnerability is network-accessible (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but needing user interaction (UI:R) in the form of visiting a malicious webpage or processing attacker-controlled web content. The scope remains unchanged (S:U), but all three impact metrics — confidentiality, integrity, and availability — are rated High (C:H/I:H/A:H), meaning a successful exploit can grant the attacker complete control over the process and potentially the underlying system. The broad attack surface is particularly notable: beyond Apple's own Safari browser and operating systems, WebKit is embedded in Oracle JDK/JRE (for JavaFX web rendering), WebKitGTK+ used across Linux distributions like Fedora and Debian, and various NetApp management products, making this a cross-platform vulnerability with wide-reaching consequences.
Frequently Asked Questions
Is CVE-2023-41993 being actively exploited?
Yes. Apple has confirmed that CVE-2023-41993 may have been actively exploited against versions of iOS before iOS 16.7. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of October 16, 2023. The ransomware association is currently listed as unknown.
What products are affected by CVE-2023-41993?
CVE-2023-41993 affects a wide range of products: Apple iPadOS, iPhone OS (iOS), and macOS are the primary targets. Additionally, Fedora, Debian Linux, Oracle GraalVM, Oracle JDK, Oracle JRE, several NetApp products (Active IQ Unified Manager, Cloud Insights, OnCommand Insight and Workflow Automation), and WebKitGTK+ are also affected due to their reliance on the WebKit engine.
How do I fix CVE-2023-41993?
Update Apple devices to macOS Sonoma 14 or later and iOS/iPadOS 16.7 or later. For Linux systems, update WebKitGTK+ packages and apply Fedora/Debian security updates. Oracle and NetApp users should consult their respective vendor advisories for patched versions. See the Remediation section for detailed steps.
How severe is CVE-2023-41993?
CVE-2023-41993 is rated High severity with a CVSS v3.1 score of 8.8 out of 10. The EPSS score of 21.71% places it in the 95.62nd percentile, indicating a very high probability of exploitation. Combined with confirmed active exploitation and wide product impact, this vulnerability demands urgent remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.