CVE-2024-23203: Apple iPadOS Auth Bypass Vulnerability

CVE-2024-23203 Overview

CVE-2024-23203 is a permissions bypass vulnerability in Apple's Shortcuts application affecting iOS, iPadOS, and macOS. A shortcut can use sensitive data with certain actions without prompting the user for authorization. Apple addressed the issue with additional permissions checks across iOS 16.7.6, iPadOS 16.7.6, iOS 17.3, iPadOS 17.3, macOS Sonoma 14.3, and macOS Ventura 13.6.5. The vulnerability is network-exploitable without authentication or user interaction, exposing confidentiality of user data on affected devices.

Critical Impact
A malicious shortcut can access sensitive user data on iOS, iPadOS, and macOS without triggering the standard consent prompt.

Affected Products

Apple iOS and iPadOS prior to 16.7.6 and 17.3
Apple macOS Sonoma prior to 14.3
Apple macOS Ventura prior to 13.6.5

Discovery Timeline

2024-01-23 - CVE-2024-23203 published to NVD
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2024-23203

Vulnerability Analysis

The vulnerability resides in the Shortcuts application, which allows users to automate tasks across Apple operating systems. Shortcuts can invoke actions that read or transmit sensitive data, including files, clipboard contents, contacts, and location. Apple's security model requires user consent before a shortcut accesses such data. The flaw allows specific actions to operate on sensitive data without triggering the consent prompt. This bypass undermines the user-mediated permission boundary that Shortcuts relies on for least-privilege execution.

Root Cause

The root cause is missing or insufficient permissions enforcement in certain Shortcuts actions. Apple's fix adds explicit permissions checks to the affected action paths. The CWE classification is recorded as NVD-CWE-noinfo, but the behavior aligns with broken access control on a sensitive data operation.

Attack Vector

An attacker distributes a crafted shortcut to a victim, typically through iCloud sharing links or shortcut galleries. When the victim imports and runs the shortcut, the malicious actions execute against sensitive data without surfacing the expected authorization dialog. No prior authentication or local privileges are required, and exploitation does not require user interaction beyond running the shortcut.

No public proof-of-concept code has been released through verified channels. See Full Disclosure January 2024 #33 and the Apple Support advisory HT214061 for technical context.

Detection Methods for CVE-2024-23203

Indicators of Compromise

Unexpected shortcuts present in the user's Shortcuts library, particularly those imported from iCloud sharing links.
Shortcut actions that read clipboard, contacts, files, or photos and then transmit data over the network without a preceding consent prompt.
Outbound HTTP or HTTPS connections from the Shortcuts process to attacker-controlled domains.

Detection Strategies

Audit installed shortcuts on managed iOS, iPadOS, and macOS endpoints to identify untrusted or recently imported automations.
Inspect MDM logs for shortcut imports originating from external iCloud links rather than corporate-approved sources.
Correlate Shortcuts process network telemetry on macOS with known data-exfiltration destinations.

Monitoring Recommendations

Track Apple OS build versions across the fleet to confirm patched releases are deployed.
Monitor for shortcut sharing URLs delivered via email, messaging apps, or web downloads.
Alert on macOS endpoints where the Shortcuts.app process accesses sensitive directories such as ~/Library or ~/Documents shortly after a new shortcut is added.

How to Mitigate CVE-2024-23203

Immediate Actions Required

Update all Apple devices to iOS 17.3, iPadOS 17.3, iOS 16.7.6, iPadOS 16.7.6, macOS Sonoma 14.3, or macOS Ventura 13.6.5 or later.
Enforce minimum OS versions through MDM compliance policies and block non-compliant devices from corporate resources.
Review and remove untrusted shortcuts from user libraries on managed devices.

Patch Information

Apple released fixes that add additional permissions checks in the Shortcuts component. Patched versions are iOS 16.7.6 and iPadOS 16.7.6, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, and macOS Ventura 13.6.5. Refer to Apple Support HT214059 and Apple Support HT214061 for full release notes.

Workarounds

Disable shortcut sharing or restrict shortcut imports through MDM configuration profiles where supported.
Instruct users not to import shortcuts received from untrusted senders or unknown iCloud sharing links.
Manually review the actions of any imported shortcut before execution, paying attention to actions that access files, contacts, clipboard, or network resources.

bash

# Verify installed Apple OS version on macOS
sw_vers -productVersion

# Example MDM compliance check (pseudocode)
# Require macOS >= 14.3 or 13.6.5, iOS/iPadOS >= 17.3 or 16.7.6