Researchers Detail Apple’s Recent Zero-Click Shortcuts Vulnerability

Facts have emerged about a now-patched substantial-severity security flaw in Apple’s Shortcuts application that could allow a shortcut to accessibility sensitive details on the machine with out users’ consent.

The vulnerability, tracked as CVE-2024-23204 (CVSS score: 7.5), was dealt with by Apple on January 22, 2024, with the release of iOS 17.3, iPadOS 17.3, macOS Sonoma 14.3, and watchOS 10.3.

“A shortcut may perhaps be equipped to use sensitive data with selected actions with no prompting the user,” the iPhone maker claimed in an advisory, stating it was fixed with “further permissions checks.”

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Apple Shortcuts is a scripting application that permits buyers to make personalized workflows (aka macros) for executing precise tasks on their equipment. It will come put in by default on iOS, iPadOS, macOS, and watchOS working programs.

Bitdefender security researcher Jubaer Alnazi Jabin, who identified and reporting the Shortcuts bug, stated it could be weaponized to produce a malicious shortcut these types of that it can bypass Transparency, Consent, and Handle (TCC) policies.

TCC is an Apple security framework which is intended to guard consumer info from unauthorized access with out requesting acceptable permissions in the initially position.

Specifically, the flaw is rooted in a shortcut motion known as “Broaden URL,” which is able of increasing and cleansing up URLs that have been shortened making use of a URL shortening support like t.co or bit.ly, whilst also eradicating UTM tracking parameters.

“By leveraging this functionality, it grew to become doable to transmit the Base64-encoded information of a picture to a destructive site,” Alnazi Jabin spelled out.

“The system requires picking any sensitive details (Photographs, Contacts, Data files, and clipboard info) in just Shortcuts, importing it, converting it making use of the foundation64 encode choice, and finally forwarding it to the malicious server.”

The exfiltrated information is then captured and saved as an graphic on the attacker’s finish making use of a Flask application, paving the way for stick to-on exploitation.

“Shortcuts can be exported and shared among the consumers, a prevalent follow in the Shortcuts local community,” the researcher stated. “This sharing mechanism extends the likely attain of the vulnerability, as customers unknowingly import shortcuts that could exploit CVE-2024-23204.”

Identified this posting attention-grabbing? Comply with us on Twitter  and LinkedIn to study a lot more special information we submit.