Apple has patched an actively exploited zero-day bug in its WebKit browser engine for Safari.
The bug, assigned as CVE-2024-23222, stems from a sort confusion error, which principally is what occurs when an utility incorrectly assumes the enter it receives is of a sure sort with out really validating — or incorrectly validating — that to be the case.
Actively Exploited
Apple yesterday described the vulnerability as one thing an attacker might exploit to execute arbitrary code on affected methods. “Apple is conscious of a report that this challenge could have been exploited,” the corporate’s advisory famous, with out providing any additional particulars.
The corporate has launched up to date variations of iOS, iPadOS, macOS, iPadOS, and tvOS with extra validation checks to deal with the vulnerability.
CVE-2024-23222 is the primary zero-day vulnerability that Apple has disclosed in WebKit in 2024. Final 12 months, the corporate disclosed a complete of 11 zero-day bugs within the know-how — its most ever in a single calendar 12 months. Since 2021, Apple has disclosed a complete of twenty-two WebKit zero-day bugs, highlighting the rising curiosity within the browser from each researchers and attackers.
In parallel, Apple’s disclosure of the brand new WebKit zero-day follows on Google’s disclosure final week of a zero-day in Chrome. It marks a minimum of the third time in current months the place each distributors have disclosed zero-days of their respective browsers in shut proximity to one another. The pattern means that researchers and attackers are probing virtually equally for flaws in each applied sciences, doubtless as a result of Chrome and Safari are additionally essentially the most extensively used browsers.
The Spying Risk
Apple has not disclosed the character of the exploit exercise focusing on the newly disclosed zero-day bug. However researchers have reported seeing business spyware and adware distributors abusing among the firm’s more moderen ones, to drop surveillance software program on iPhones of goal topics.
In September 2023, Toronto College’s Citizen Lab warned Apple about two no-click zero-day vulnerabilities in iOS {that a} vendor of surveillance software program had exploited to drop the Predator spyware and adware instrument on an iPhone belonging to an worker at a Washington, D.C.-based group. The identical month, Citizen Lab researchers additionally reported a separate zero-day exploit chain — which included a Safari bug — they’d found focusing on iOS units.
Google has flagged comparable considerations in Chrome, virtually in tandem with Apple, on a couple of events lately. In September 2023, as an example, close to the identical time Apple disclosed its zero-day bugs, researchers from Google’s menace evaluation group recognized a business software program firm referred to as Intellexa as creating an exploit chain — which included a Chrome zero-day (CVE-2023-4762) — to put in Predator on Android units. Only a few days earlier, Google had disclosed one other zero-day in Chrome (CVE-2023-4863) in the identical picture processing library during which Apple had disclosed a zero-day.
Lionel Litty, chief safety architect at browser safety agency Menlo Safety, says it is exhausting to say if there’s any connection between Google and Apple’s first browser zero-days for 2024, given the restricted info at the moment accessible. “The Chrome CVE was within the JavaScript engine (v8) and Safari makes use of a distinct JavaScript engine,” Litty says. “Nevertheless, it’s not unusual for various implementations to have very comparable flaws.”
As soon as attackers have discovered a tender spot in a single browser, they’re additionally recognized to probe different browsers in the identical space, Litty says. “So, whereas it is unlikely that that is the very same vulnerability, it would not be too stunning if there was some shared DNA between the 2 in-the-wild exploits.”
Explosion in Zero-Hour Browser-Based mostly Phishing Assaults
Surveillance distributors are, by far, not the one ones making an attempt to take advantage of browser vulnerabilities and browsers usually. In response to a soon-to-be-released report from Menlo Safety, there was a 198% improve in browser-based phishing assaults within the second half of 2023 in comparison with the primary six months of the 12 months. Evasive assaults — a class that Menlo describes as utilizing methods to evade conventional safety controls — surged even larger, by 206%, and accounted for 30% of all browser-based assaults within the second half of 2023.
Over a 30-day interval, Menlo says it noticed greater than 11,000 so-called “zero-hour” browser-based phishing assaults evade Safe Net Gateway and different endpoint menace detection instruments.
“The browser is the enterprise utility enterprises cannot dwell with out, nevertheless it has fallen behind from a safety and manageability perspective,” Menlo stated within the upcoming report.
