Particulars have emerged a few now-patched high-severity safety flaw in Apple’s Shortcuts app that might allow a shortcut to entry delicate data on the system with out customers’ consent.
The vulnerability, tracked as CVE-2024-23204 (CVSS rating: 7.5), was addressed by Apple on January 22, 2024, with the discharge of iOS 17.3, iPadOS 17.3, macOS Sonoma 14.3and watchOS 10.3.
“A shortcut may be able to use sensitive data with certain actions without prompting the user,” the iPhone maker mentioned in an advisory, stating it was mounted with “additional permissions checks.”
Apple Shortcuts is a scripting application that enables customers to create personalised workflows (aka macros) for executing specific tasks on their units. It comes put in by default on iOS, iPadOS, macOS, and watchOS working programs.
Bitdefender safety researcher Jubaer Alnazi Jabin, who found and reporting the Shortcuts bug, mentioned it could possibly be weaponized to create a malicious shortcut such that it will possibly bypass Transparency, Consent, and Management (TCC) insurance policies.
TCC is an Apple security framework that is designed to guard person information from unauthorized entry with out requesting acceptable permissions within the first place.
Particularly, the flaw is rooted in a shortcut motion known as “Expand URL,” which is able to increasing and cleansing up URLs which were shortened utilizing a URL shortening service like t.co or bit.ly, whereas additionally eradicating UTM tracking parameters.
“By leveraging this functionality, it became possible to transmit the Base64-encoded data of a photo to a malicious website,” Alnazi Jabin explained.
“The method involves selecting any sensitive data (Photos, Contacts, Files, and clipboard data) within Shortcuts, importing it, converting it using the base64 encode option, and ultimately forwarding it to the malicious server.”
The exfiltrated information is then captured and saved as a picture on the attacker’s finish utilizing a Flask utility, paving the best way for follow-on exploitation.
“Shortcuts can be exported and shared among users, a common practice in the Shortcuts community,” the researcher mentioned. “This sharing mechanism extends the potential reach of the vulnerability, as users unknowingly import shortcuts that might exploit CVE-2024-23204.”
Author: information@thehackernews.com (The Hacker Information)
Date: 2024-02-23 00:05:00
