CVE-2024-27821: Apple iPadOS Path Traversal Vulnerability

CVE-2024-27821 Overview

CVE-2024-27821 is a path handling vulnerability in Apple's Shortcuts framework affecting iOS, iPadOS, macOS Sonoma, and watchOS. The flaw allows a maliciously crafted shortcut to output sensitive user data without triggering the standard consent prompts. Apple addressed the issue with improved path validation in iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, and watchOS 10.5. The weakness is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Exploitation requires local access and user interaction, which reduces the attack surface but does not eliminate risk in shared or multi-user environments.

Critical Impact
A crafted shortcut can bypass user consent controls and exfiltrate sensitive data from the device.

Affected Products

Apple iOS and iPadOS prior to 17.5
Apple macOS Sonoma prior to 14.5
Apple watchOS prior to 10.5

Discovery Timeline

2024-05-14 - CVE-2024-27821 published to the National Vulnerability Database
2024-05-14 - Apple published advisories HT214101, HT214104, and HT214106 documenting the fix
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27821

Vulnerability Analysis

The vulnerability resides in the Shortcuts application's handling of file and resource paths. Shortcuts is Apple's automation framework that lets users chain actions across apps, including access to Photos, Files, Contacts, and Health data. Normally, actions that read sensitive user data trigger a system-level consent dialog. The path handling flaw allows a shortcut to reference protected resources in a form the validation logic does not recognize as sensitive. As a result, the shortcut returns data to its output without the standard permission prompt. The flaw does not grant code execution or write access; its impact is limited to confidentiality.

Root Cause

The root cause is improper pathname validation [CWE-22]. The Shortcuts runtime did not canonicalize or fully normalize paths before mapping them to the Transparency, Consent, and Control (TCC) permission boundaries. A crafted path reference could resolve to protected content while evading the checks that would normally invoke consent gating.

Attack Vector

The attack requires an attacker to deliver a malicious shortcut and persuade a user to run it. Shortcuts can be shared through iCloud links, messaging apps, or websites. On execution, the shortcut reads sensitive resources using the manipulated path and returns the content as output, which can then be transmitted to an attacker-controlled destination through built-in sharing or HTTP actions. No verified public proof-of-concept code is available. Technical descriptions were discussed on the Full Disclosure mailing list in May 2024.

See the Full Disclosure May 10 post and the Apple Support advisory HT214101 for additional context.

Detection Methods for CVE-2024-27821

Indicators of Compromise

Unexpected or unsolicited .shortcut files received through Messages, Mail, AirDrop, or iCloud sharing links
Shortcuts containing combinations of file-read actions and outbound network actions such as Get Contents of URL
Device running an Apple operating system version earlier than iOS 17.5, iPadOS 17.5, macOS 14.5, or watchOS 10.5

Detection Strategies

Audit installed shortcuts on managed Apple devices through Mobile Device Management (MDM) inventory and flag shortcuts that reference Photos, Files, Contacts, or Health data combined with network output
Correlate Shortcuts execution events with outbound HTTPS requests to non-corporate domains using endpoint telemetry
Review macOS unified logs for com.apple.shortcuts subsystem entries that indicate access to protected resources without a preceding user consent event

Monitoring Recommendations

Track OS version compliance across the Apple fleet to confirm devices are patched to 17.5, 14.5, or 10.5 or later
Monitor for shortcut imports from external sources and apply policy to restrict untrusted automation files on managed devices
Alert on anomalous data egress patterns originating from the Shortcuts process, particularly to newly registered or uncategorized domains

How to Mitigate CVE-2024-27821

Immediate Actions Required

Update affected devices to iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, or watchOS 10.5 or later
Audit third-party shortcuts installed on user devices and remove any from untrusted sources
Educate users to decline shortcut imports from unknown senders and to review each action before running a shared shortcut

Patch Information

Apple shipped the fix on May 13, 2024. Refer to Apple Support HT214101 (macOS Sonoma 14.5), Apple Support HT214104 (iOS and iPadOS 17.5), and Apple Support HT214106 (watchOS 10.5) for release notes. Apple also hosts the newer URLs 120902, 120903, and 120905.

Workarounds

Restrict shortcut sharing on managed devices through MDM configuration profiles that disable iCloud sharing for Shortcuts
Require explicit administrator approval before users install shortcuts from external sources
Remove unused or legacy shortcuts that request access to Photos, Contacts, Files, or Health data

bash

# Verify macOS build version meets the patched release
sw_vers -productVersion
# Expected output: 14.5 or later for macOS Sonoma

# On iOS/iPadOS, confirm via Settings > General > About > Software Version
# Expected: 17.5 or later