CVE-2024-44255: Apple iPadOS Path Traversal Vulnerability

CVE-2024-44255 Overview

CVE-2024-44255 is a path handling vulnerability affecting multiple Apple operating systems. The flaw allows a malicious app to run arbitrary shortcuts without user consent. Apple addressed the issue with improved logic across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The vulnerability is classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory) and requires local access with user interaction to exploit.

Critical Impact
A malicious application installed on an affected Apple device can execute arbitrary Shortcuts automation flows without prompting the user, bypassing the consent model that normally gates Shortcuts execution.

Affected Products

Apple iOS and iPadOS versions prior to 18.1
Apple macOS Sequoia prior to 15.1, macOS Sonoma prior to 14.7.1, macOS Ventura prior to 13.7.1
Apple tvOS prior to 18.1, visionOS prior to 2.1, watchOS prior to 11.1

Discovery Timeline

2024-10-28 - CVE-2024-44255 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-44255

Vulnerability Analysis

The vulnerability resides in how the Shortcuts subsystem resolves and validates path references when invoking automation flows. A malicious application can craft input that circumvents the consent prompt that normally gates shortcut execution. Apple's advisories describe the root cause as a path handling issue and note that the fix introduces improved logic to validate paths correctly.

Successful exploitation grants a local attacker the ability to trigger existing user-defined Shortcuts. Because Shortcuts can chain actions across system services, file access, network requests, and third-party apps, silent execution of an arbitrary shortcut can lead to confidentiality, integrity, and availability impacts on user data.

Root Cause

The root cause is improper path normalization and validation within the Shortcuts pathway that identifies which shortcut to execute. Insufficient canonicalization enables an attacker-controlled application to reference shortcuts that should require explicit user consent, bypassing the authorization prompt.

Attack Vector

Exploitation requires a malicious application to be installed and executed on the target device. The attacker leverages the crafted app to invoke the Shortcuts execution interface with attacker-controlled path input. User interaction is required to run the malicious app, but no interaction is required to approve the shortcut execution itself, which is the crux of the flaw. Refer to the Apple Support Document #121563 and companion advisories for platform-specific technical notes.

Detection Methods for CVE-2024-44255

Indicators of Compromise

Unexpected Shortcuts automation runs recorded in the Shortcuts app history without a corresponding user-triggered event
Newly installed third-party apps that invoke the Shortcuts URL scheme or x-callback-url handlers shortly after launch
Anomalous outbound network connections or file access originating from processes spawned by shortcuts on macOS

Detection Strategies

Inventory managed Apple endpoints and flag devices running OS builds below the patched versions listed in the Apple advisories
Monitor MDM telemetry for installation of unsigned or side-loaded applications that interact with the Shortcuts framework
Correlate Shortcuts execution events with foreground app activity to identify runs invoked by background or non-interactive apps

Monitoring Recommendations

Enable Endpoint Detection and Response (EDR) telemetry on macOS to capture shortcuts command-line invocations and child process creation
Track OS version compliance across the fleet and generate alerts for devices that remain on vulnerable builds
Review App Store and enterprise app deployment logs for suspicious apps requesting Shortcuts-related entitlements

How to Mitigate CVE-2024-44255

Immediate Actions Required

Update all Apple devices to iOS 18.1, iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, tvOS 18.1, visionOS 2.1, or watchOS 11.1 or later
Audit installed Shortcuts for actions that access sensitive data, credentials, or perform destructive operations, and remove any unused automations
Restrict installation of untrusted third-party applications through MDM policy enforcement

Patch Information

Apple released fixes across the affected platforms on October 28, 2024. Patch details are published in Apple Support Document #121563, Apple Support Document #121565, Apple Support Document #121566, Apple Support Document #121568, Apple Support Document #121569, and Apple Support Document #121570. The fix introduces improved path validation logic within the Shortcuts subsystem.

Workarounds

No official workaround exists; applying the vendor patch is the recommended remediation path
Disable or remove sensitive Shortcuts automations on unpatched devices until updates are deployed
Limit device access to trusted App Store applications and block enterprise sideloading where feasible

bash

# Verify macOS build version on managed endpoints
sw_vers -productVersion

# Trigger a software update check via command line
sudo softwareupdate --list
sudo softwareupdate --install --all --restart