CVE-2024-40794: Apple Safari Auth Bypass Vulnerability

CVE-2024-40794 Overview

CVE-2024-40794 is an authentication bypass vulnerability affecting Apple Safari, iOS, iPadOS, and macOS. The vulnerability exists due to improper state management in the Safari browser, which allows Private Browsing tabs to be accessed without authentication. This flaw could enable an attacker with local access to a device to view sensitive browsing data that users expected to remain private and protected.

Critical Impact

Unauthorized access to Private Browsing tabs exposes sensitive user browsing history, session data, and potentially confidential information that users believed was protected by Safari's privacy features.

Affected Products

• Apple Safari versions prior to 17.6
• Apple iOS versions prior to 17.6
• Apple iPadOS versions prior to 17.6
• Apple macOS Sonoma versions prior to 14.6

Discovery Timeline

• 2024-07-29 - CVE-2024-40794 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2024-40794

Vulnerability Analysis

This vulnerability stems from improper state management within Safari's Private Browsing implementation. Private Browsing mode is designed to provide users with enhanced privacy by not storing browsing history, cookies, or other session data after the browsing window is closed. Critically, Safari implements authentication requirements to prevent unauthorized access to open Private Browsing tabs when a device is shared or left unattended.

The flaw in state management allows these authentication controls to be bypassed, meaning an attacker with physical or local access to a device could potentially view the contents of Private Browsing tabs without providing the required authentication credentials. This undermines a core privacy feature that many users rely upon for sensitive browsing activities such as financial transactions, healthcare information access, or confidential research.

The vulnerability affects multiple Apple platforms including macOS, iOS, and iPadOS, amplifying its potential impact across Apple's ecosystem of devices.

Root Cause

The root cause of CVE-2024-40794 is a state management flaw (CWE-287: Improper Authentication) in Safari's Private Browsing functionality. The browser fails to properly enforce authentication requirements when transitioning between certain application states, allowing the authentication check to be circumvented under specific conditions.

Attack Vector

The attack vector for this vulnerability is network-accessible, though practical exploitation would typically require local or physical access to the target device. An attacker could exploit this vulnerability by manipulating the browser's state to bypass the authentication mechanism protecting Private Browsing tabs.

The exploitation scenario involves:

1. Gaining access to a device with Safari Private Browsing tabs open
2. Triggering specific state transitions that bypass authentication checks
3. Viewing the contents of protected Private Browsing sessions without authorization

Due to the nature of this vulnerability, no code example is provided. The exploitation involves manipulating Safari's internal state management rather than injecting specific payloads. Technical details regarding the specific state transitions that enable bypass are documented in the Full Disclosure posts and Apple's security advisories.

Detection Methods for CVE-2024-40794

Indicators of Compromise

• Unusual access patterns to Private Browsing tabs when the device was expected to be locked
• Safari process state anomalies or unexpected authentication prompt behavior
• Evidence of session access without corresponding authentication events in system logs

Detection Strategies

• Monitor Safari browser version across managed devices to identify unpatched installations
• Implement endpoint detection rules to identify Safari versions prior to 17.6
• Deploy Mobile Device Management (MDM) policies to enforce minimum browser versions

Monitoring Recommendations

• Enable detailed logging for Safari authentication events on enterprise-managed devices
• Monitor for unusual browser state transitions through endpoint telemetry
• Track software inventory to ensure all Apple devices are running patched versions

How to Mitigate CVE-2024-40794

Immediate Actions Required

• Update Safari to version 17.6 or later immediately
• Update iOS and iPadOS devices to version 17.6 or later
• Update macOS Sonoma to version 14.6 or later
• Close all Private Browsing tabs when leaving devices unattended until patches are applied

Patch Information

Apple has addressed this vulnerability through improved state management in the following updates:

• Safari 17.6 - See Apple Support Article HT214119
• iOS 17.6 and iPadOS 17.6 - See Apple Support Article HT214117
• macOS Sonoma 14.6 - See Apple Support Article HT214121

Debian-based systems using WebKitGTK should reference the Debian LTS Announcement for applicable updates.

Workarounds

• Manually close all Private Browsing tabs before leaving devices unattended
• Enable device screen lock with short timeout intervals to reduce exposure window
• Use separate user accounts on shared devices to provide isolation
• Consider using alternative browsers for sensitive browsing until patches are applied

# Verify Safari version on macOS
/Applications/Safari.app/Contents/MacOS/Safari --version

# Check for available macOS updates
softwareupdate --list

# Install all available security updates
softwareupdate --install --all