CVE-2024-23277: Apple iPadOS Keystroke Injection Vulnerability

CVE-2024-23277 Overview

CVE-2024-23277 is an input validation weakness in Apple iOS, iPadOS, and macOS that allows an attacker in a privileged network position to inject keystrokes by spoofing a keyboard. Apple addressed the issue with improved checks in iOS 17.4, iPadOS 17.4, and macOS Sonoma 14.4. Successful exploitation lets an adjacent attacker deliver arbitrary input to a targeted device, which can lead to unauthorized actions under the current user context. The flaw was published to the National Vulnerability Database (NVD) on March 8, 2024.

Critical Impact
An attacker in a privileged network position can inject arbitrary keystrokes into a victim device by impersonating a paired or trusted keyboard, undermining input integrity.

Affected Products

Apple iOS (versions prior to 17.4)
Apple iPadOS (versions prior to 17.4)
Apple macOS Sonoma (versions prior to 14.4)

Discovery Timeline

2024-03-08 - CVE-2024-23277 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23277

Vulnerability Analysis

CVE-2024-23277 is an input validation weakness [NVD-CWE-noinfo] in Apple's keyboard input handling that permits keyboard spoofing. An attacker positioned adjacent to the target on the same wireless or Bluetooth channel can impersonate a legitimate Human Interface Device (HID) keyboard. Once the spoofed device is accepted as an input source, the attacker can transmit keystrokes that the operating system processes as user input. Because the injected input runs in the context of the active session, it can trigger commands, launch applications, or alter data without the victim's consent. Apple resolved the issue with improved checks that validate the origin and legitimacy of keyboard input events.

Root Cause

The root cause is insufficient verification of the source and authenticity of keyboard HID input. Apple's original implementation did not adequately confirm that keystrokes originated from a properly authenticated, trusted device before injecting them into the input event stream. The patched builds add explicit checks to validate keyboard input, closing the spoofing path.

Attack Vector

Exploitation requires proximity or an existing privileged position on the network path between the target device and an authorized keyboard. The attacker impersonates the keyboard, negotiates the input association, and delivers crafted HID reports containing arbitrary key events. High attack complexity applies because the attacker must be within range and time the impersonation correctly. No user interaction and no prior authentication on the target device are needed to complete the injection. Consult the Apple Support Article HT214081 and Apple Support Article HT214084 advisories for the vendor's technical description.

Detection Methods for CVE-2024-23277

Indicators of Compromise

Unexpected pairing or reconnection events involving Bluetooth keyboards on iOS, iPadOS, or macOS endpoints.
Keyboard input events occurring while the physical keyboard is idle, disconnected, or out of range.
Application launches, spotlight searches, or shell commands that the legitimate user did not initiate.
New or unknown Bluetooth HID device identifiers appearing in device pairing logs.

Detection Strategies

Correlate Bluetooth pairing telemetry with user activity timelines to spot keystrokes originating from unattended sessions.
Monitor macOS unified logs and iOS device management event streams for anomalous HID device connections.
Flag endpoints running iOS, iPadOS, or macOS versions below the patched builds during vulnerability scans.

Monitoring Recommendations

Ingest Bluetooth and HID pairing events from managed Apple endpoints into a centralized log platform for correlation.
Alert on repeated pairing attempts, MAC address changes for keyboard peripherals, or unexpected reconnections outside business hours.
Track OS version compliance across the fleet and generate alerts for devices that remain on pre-patch builds.

How to Mitigate CVE-2024-23277

Immediate Actions Required

Update all iPhone and iPad devices to iOS 17.4 or iPadOS 17.4 or later.
Update Mac systems to macOS Sonoma 14.4 or later.
Audit paired Bluetooth keyboards on managed Apple endpoints and remove unknown or unused devices.
Enforce mobile device management (MDM) policies that require the latest patched OS versions before granting corporate resource access.

Patch Information

Apple released fixes for CVE-2024-23277 in iOS 17.4, iPadOS 17.4, and macOS Sonoma 14.4. Refer to Apple Support Document #120893 and Apple Support Document #120895 for the full list of addressed issues and installation guidance. Additional context is available in the Full Disclosure Mailing List Update.

Workarounds

Disable Bluetooth on affected devices when a paired keyboard is not in active use.
Avoid pairing keyboards or accepting new Bluetooth connections in untrusted or public environments.
Remove stale keyboard pairings from device settings to reduce the impersonation attack surface.
Restrict device usage on untrusted wireless networks until patched builds are deployed.

bash

# Verify installed macOS version to confirm patch level
sw_vers -productVersion

# List paired Bluetooth devices on macOS for audit
system_profiler SPBluetoothDataType | grep -E "Address|Minor Type|Name"