CVE-2024-44309
Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability
Description
CVE-2024-44309 is a medium-severity cross-site scripting (XSS) vulnerability caused by a cookie management issue in Apple's WebKit engine, affecting Safari, iOS, iPadOS, macOS Sequoia, and visionOS. With a CVSS v3.1 base score of 6.1, the vulnerability allows an attacker to execute cross-site scripting attacks when a user processes maliciously crafted web content. Apple has acknowledged that this issue may have been actively exploited on Intel-based Mac systems. CISA has added CVE-2024-44309 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 12, 2024, and its ransomware association is classified as Unknown. The EPSS score of 1.03% at the 77.0th percentile indicates moderate but noteworthy exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:LOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| debian | debian linux | 11.0 |
| apple | safari | < 18.1.1 |
| apple | ipados | < 17.7.2; >= 18.0, < 18.1.1 |
| apple | iphone os | < 17.7.2; >= 18.0, < 18.1.1 |
| apple | macos | >= 15.0, < 15.1.1 |
| apple | visionos | < 2.1.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
References
- https://support.apple.com/en-us/121752(Vendor Advisory)
- https://support.apple.com/en-us/121753(Vendor Advisory)
- https://support.apple.com/en-us/121754(Vendor Advisory)
- https://support.apple.com/en-us/121755(Vendor Advisory)
- https://support.apple.com/en-us/121756(Vendor Advisory)
- http://seclists.org/fulldisclosure/2024/Nov/16(Mailing List, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2024/12/msg00003.html(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-44309(US Government Resource)
Weakness Type
Cross-Site Scripting (XSS) via Cookie Management Flaw
CVE-2024-44309 is a cross-site scripting vulnerability that stems from improper cookie management and state handling in Apple's WebKit browser engine. The flaw allows an attacker to inject and execute malicious scripts in the context of a victim's browsing session by exploiting how WebKit manages cookie state. When a user visits a maliciously crafted web page or processes attacker-controlled web content, the cookie management weakness can be leveraged to execute JavaScript in the security context of another origin, bypassing the same-origin policy. XSS vulnerabilities in browser engines are particularly dangerous because they affect all websites visited by the user and can lead to session hijacking, credential theft, and unauthorized actions. Learn more about CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Impact Analysis
The impact of CVE-2024-44309 is focused on confidentiality and integrity with a changed scope, meaning the vulnerability in WebKit can affect resources beyond the vulnerable component itself. Confidentiality experiences low impact (C:L) in the CVSS vector, but in practice, a successful XSS attack in a browser engine can access cookies, session tokens, and locally stored data for the affected origin. The changed scope (S:C) indicates that the XSS can cross security boundaries, potentially allowing an attacker to steal authentication tokens or sensitive data from web applications the victim is logged into.
Integrity faces low impact (I:L) per the CVSS vector, reflecting the ability to modify page content, inject phishing elements, or perform actions on behalf of the victim within the affected web application. In targeted attacks, this can be leveraged to modify displayed content, redirect users to phishing pages, or trigger unauthorized transactions.
Apple's acknowledgment that this issue "may have been actively exploited on Intel-based Mac systems" elevates the practical risk beyond what the medium CVSS score suggests. The vulnerability's presence in the WebKit engine means it affects a wide range of Apple devices and platforms. The attack requires user interaction (UI:R) in the form of visiting a malicious webpage or processing crafted web content, but this is easily achievable through phishing links, malicious advertisements, or compromised websites. The EPSS score of 1.03% at the 77th percentile is moderate but notable for an XSS vulnerability, reflecting confirmed in-the-wild exploitation.
Exploit Maturity
CVE-2024-44309 has confirmed active exploitation, with Apple specifically acknowledging that the issue "may have been actively exploited on Intel-based Mac systems." CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 12, 2024.
The EPSS score of 1.03% at the 77.0th percentile indicates moderate exploitation activity, which is notable for a cross-site scripting vulnerability. The confirmed exploitation on Intel-based Mac systems suggests this vulnerability may have been used in targeted attacks, potentially as part of a sophisticated attack chain. Apple released fixes simultaneously across multiple products: Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1 and iPadOS 18.1.1, and visionOS 2.1.1. CVE-2024-44309 was disclosed alongside CVE-2024-44308, a related WebKit vulnerability enabling arbitrary code execution, suggesting both may have been part of the same exploitation campaign targeting Intel-based Mac users. The ransomware association remains Unknown.
Remediation
-
Update all affected Apple devices and software immediately. Install the latest security updates across all affected platforms: Safari 18.1.1, iOS 17.7.2 or iOS 18.1.1, iPadOS 17.7.2 or iPadOS 18.1.1, macOS Sequoia 15.1.1, and visionOS 2.1.1. Apple's security updates are available through the standard software update mechanisms on each platform.
-
Prioritize Intel-based Mac systems. Apple has specifically acknowledged active exploitation on Intel-based Mac systems. Organizations with Intel-based Mac fleets should treat this as an emergency update. Verify that macOS Sequoia 15.1.1 and Safari 18.1.1 are deployed across all Intel-based Mac systems before extending to other platforms.
-
Address CVE-2024-44308 simultaneously. CVE-2024-44309 was disclosed alongside CVE-2024-44308, a high-severity arbitrary code execution vulnerability in WebKit's JavaScriptCore. Both vulnerabilities were likely exploited together in the same attack chain, and both are addressed in the same set of Apple security updates. Ensure your update addresses both CVEs.
-
Enable automatic updates on all Apple devices. Configure automatic security updates on all managed Apple devices to ensure rapid deployment of future critical patches. For enterprise environments, use MDM (Mobile Device Management) solutions to push updates and verify compliance across the device fleet.
-
Educate users about phishing risks during the patch window. Since exploitation requires user interaction (visiting a malicious web page), warn users about the heightened risk of phishing links and malicious websites until all devices are patched. Recommend caution with unfamiliar links, especially on Intel-based Mac systems.
Technical Details
CVE-2024-44309 carries a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, resulting in a medium base score of 6.1. The vector indicates a network-accessible vulnerability (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but needing user interaction (UI:R) in the form of visiting a malicious web page. The scope is changed (S:C), meaning the vulnerability in WebKit can impact resources outside the vulnerable component's security scope, with low confidentiality (C:L) and integrity (I:L) impact.
The vulnerability is rooted in a cookie management issue within Apple's WebKit browser engine. WebKit is the rendering engine used by Safari and is the mandatory browser engine for all iOS and iPadOS browsers. The flaw lies in how WebKit handles cookie state management, where improper state transitions or insufficient validation of cookie-related data creates a condition exploitable for cross-site scripting. When a user processes maliciously crafted web content, the attacker can leverage the cookie management weakness to execute JavaScript in the security context of a different origin than the malicious page.
The changed scope (S:C) is a critical aspect of this vulnerability's CVSS vector. It indicates that the XSS attack can affect resources beyond the WebKit component itself, potentially compromising the security context of web applications the user is logged into. The user interaction requirement (UI:R) means the victim must navigate to or be redirected to attacker-controlled content, but this is trivially achievable through phishing, malvertising, or watering hole attacks. Apple's acknowledgment of active exploitation on Intel-based Mac systems specifically points to targeted attacks that may have used this XSS vulnerability in combination with CVE-2024-44308 to achieve a more powerful exploit chain. Affected products include Safari versions before 18.1.1, iOS and iPadOS versions before 17.7.2 and 18.1.1, macOS Sequoia versions before 15.1.1, and visionOS versions before 2.1.1.
Frequently Asked Questions
What is CVE-2024-44309?
CVE-2024-44309 is a cross-site scripting vulnerability in Apple's WebKit browser engine caused by a cookie management issue. It allows attackers to execute malicious scripts when a user processes crafted web content. Apple has confirmed it may have been actively exploited on Intel-based Mac systems.
Which Apple products are affected by CVE-2024-44309?
The vulnerability affects Safari (before 18.1.1), iOS and iPadOS (before 17.7.2 and 18.1.1), macOS Sequoia (before 15.1.1), and visionOS (before 2.1.1). Since WebKit is the engine underlying all browsers on iOS and iPadOS, all browsers on those platforms are affected regardless of brand.
How does CVE-2024-44309 relate to CVE-2024-44308?
Both vulnerabilities were disclosed simultaneously by Apple and affect the WebKit engine. CVE-2024-44309 enables cross-site scripting through a cookie management flaw, while CVE-2024-44308 allows arbitrary code execution through a JavaScriptCore issue. Both were potentially exploited on Intel-based Mac systems and may have been used together in a targeted attack chain.
Is CVE-2024-44309 being exploited in the wild?
Yes. Apple has acknowledged that this issue "may have been actively exploited on Intel-based Mac systems," and CISA has added it to the Known Exploited Vulnerabilities catalog. While the exploitation appears to have been targeted rather than widespread, all users of affected Apple products should update immediately.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.