CVE-2024-23284: Apple Safari XSS Vulnerability

CVE-2024-23284 Overview

CVE-2024-23284 is a logic vulnerability in Apple's WebKit browser engine that allows maliciously crafted web content to bypass Content Security Policy (CSP) enforcement [CWE-693: Protection Mechanism Failure]. The flaw affects Safari and multiple Apple operating systems, along with downstream WebKit consumers such as WebKitGTK, WPE WebKit, and Fedora distributions that ship these components. Apple addressed the issue with improved state management in Safari 17.4, iOS 16.7.6, iPadOS 16.7.6, iOS 17.4, iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, and watchOS 10.4.

Critical Impact
A successful exploit disables CSP protections in the victim's browser, exposing users to cross-site scripting, data exfiltration, and unauthorized content injection on sites that rely on CSP as a defense-in-depth control.

Affected Products

Apple Safari (prior to 17.4), iOS/iPadOS (prior to 16.7.6 and 17.4), macOS Sonoma (prior to 14.4), tvOS (prior to 17.4), visionOS (prior to 1.1), watchOS (prior to 10.4)
WebKitGTK and WPE WebKit builds prior to the corresponding upstream fix
Fedora 38, 39, and 40 packages shipping the vulnerable WebKit versions

Discovery Timeline

2024-03-08 - CVE-2024-23284 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23284

Vulnerability Analysis

CVE-2024-23284 is a business logic flaw in WebKit's Content Security Policy enforcement path. Content Security Policy is a browser security standard that restricts which scripts, styles, and resources a page can load. When a user processes maliciously crafted web content, the browser fails to consistently apply the configured CSP directives, permitting content that the policy should block.

The vulnerability requires user interaction: the victim must visit or interact with attacker-controlled web content. Confidentiality and availability are not directly affected, but integrity is significantly impacted because CSP is a primary defense against script injection on modern web applications.

Root Cause

Apple's advisory describes the issue as a logic error corrected through improved state management. State management defects in policy engines typically occur when the browser fails to propagate or re-evaluate the active policy across navigations, frame boundaries, service worker interception, or specific resource load types. The result is a window in which CSP directives are not enforced against a request that would otherwise be blocked.

Attack Vector

Exploitation is remote and web-based. An attacker hosts a page that constructs a specific sequence of DOM operations, navigations, or resource loads that trigger the flawed state transition inside WebKit. Once CSP enforcement is skipped, the attacker can execute inline script, load external script sources, or perform other actions that a properly enforced policy would prohibit. No authentication is required, and the network attack complexity is low.

No verified public exploit code is available for CVE-2024-23284. Technical details are available in the Apple Security Advisory HT214084 and the related WebKit security bulletins.

Detection Methods for CVE-2024-23284

Indicators of Compromise

Web traffic containing CSP violation reports that suddenly stop for known-policy-protected origins, indicating enforcement may have been bypassed rather than the content becoming compliant.
Client telemetry showing Safari or WebKit-based browser versions below the patched builds (Safari 17.4, iOS/iPadOS 17.4, macOS 14.4) accessing untrusted web content.
Endpoint logs recording script execution or outbound connections from browser processes to domains not listed in the site's expected CSP allowlist.

Detection Strategies

Inventory browser and WebKit component versions across managed macOS, iOS, iPadOS, tvOS, visionOS, and watchOS devices using an endpoint management or EDR platform.
Correlate browser process telemetry with proxy or DNS logs to surface script loads that violate expected CSP directives on internal or high-value web applications.
Monitor Linux endpoints running WebKitGTK or WPE WebKit for outdated package versions on Fedora 38, 39, and 40.

Monitoring Recommendations

Enable CSP report-only or report-uri collection on internally hosted applications so violations are captured centrally for analysis.
Track patch compliance for Apple software updates and Fedora WebKit package advisories as part of routine vulnerability management reporting.
Alert on user agents advertising vulnerable WebKit versions accessing sensitive web portals.

How to Mitigate CVE-2024-23284

Immediate Actions Required

Upgrade Safari to 17.4, iOS/iPadOS to 16.7.6 or 17.4, macOS to Sonoma 14.4, tvOS to 17.4, visionOS to 1.1, and watchOS to 10.4.
Update WebKitGTK and WPE WebKit packages on Linux systems using the vendor-supplied patches, including the Fedora updates referenced in the Fedora package announcements.
Enforce mobile device management (MDM) policies that require the minimum patched OS versions before granting access to corporate resources.

Patch Information

Apple published fixes across its product line on March 7, 2024. Refer to Apple Security Update HT214081, HT214082, HT214084, HT214086, HT214087, HT214088, and HT214089 for platform-specific details. Fedora shipped corresponding WebKit updates for versions 38, 39, and 40.

Workarounds

Restrict browsing on unpatched devices to trusted internal sites until updates can be applied.
Deploy web filtering or secure web gateway policies that block known malicious domains and reduce exposure to hostile web content.
On managed macOS systems, consider temporarily using an alternate browser with independent CSP handling for high-risk browsing until patches are installed.

bash

# Verify Safari version on macOS
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString

# Check installed WebKitGTK version on Fedora
rpm -q webkit2gtk4.0 webkit2gtk4.1

# Apply pending Apple software updates on macOS
sudo softwareupdate -i -a -R

# Update WebKitGTK on Fedora
sudo dnf update webkit2gtk4.0 webkit2gtk4.1