CVE-2024-54467 Overview
CVE-2024-54467 is a cookie management flaw in Apple Safari and multiple Apple operating systems. A malicious website can exploit the issue to exfiltrate data across origins, breaking the same-origin policy that isolates web content. Apple addressed the defect with improved state management in Safari 18, iOS 18, iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, and watchOS 11. The weakness maps to [CWE-200] Information Exposure and requires user interaction, typically visiting an attacker-controlled page. Debian also republished the fix through its LTS security channel for downstream WebKit consumers.
Critical Impact
A malicious website can exfiltrate sensitive data cross-origin from a victim's browser session, undermining web isolation guarantees.
Affected Products
- Apple Safari (prior to Safari 18)
- Apple iOS and iPadOS (prior to version 18)
- Apple macOS Sequoia (prior to 15), tvOS 18, visionOS 2, watchOS 11
Discovery Timeline
- 2025-03-10 - CVE-2024-54467 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD
Technical Details for CVE-2024-54467
Vulnerability Analysis
The vulnerability originates in how Safari and WebKit track cookie state across browsing contexts. Improper state management allows a crafted site to influence cookie handling in a way that leaks data belonging to another origin. This defeats the same-origin policy, which is the foundational browser control that prevents one site from reading responses or storage belonging to another.
Exploitation requires user interaction. A victim must visit or otherwise load malicious web content. Once loaded, the attacker's page manipulates cookie handling to observe or reference data associated with a different origin the user is authenticated to. The impact is confidentiality loss without required modification of data or disruption of service.
Apple's advisory characterizes the fix as improved state management, indicating that the underlying cookie store or associated request context was not consistently scoped to the correct origin under specific sequences of navigation or storage access.
Root Cause
The root cause is inconsistent state tracking in WebKit's cookie management layer. Cookies were handled in a way that permitted a malicious origin to observe or influence data belonging to another origin, categorized as [CWE-200] Information Exposure.
Attack Vector
The attack vector is network-based through a web browser. An attacker hosts malicious content, then lures a targeted user to visit the page. No credentials are required on the attacker side, but victim interaction is necessary for the malicious page to load and execute its logic against the vulnerable WebKit cookie store.
No public proof-of-concept or exploit code has been published for CVE-2024-54467. Technical specifics beyond Apple's advisory language are not disclosed. See the Apple Support Advisory #121238 and companion advisories for platform-specific details.
Detection Methods for CVE-2024-54467
Indicators of Compromise
- Safari or WebKit-based application versions below the fixed releases (Safari 18, iOS/iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11).
- Outbound web requests from user endpoints to suspicious or newly registered domains immediately following visits to unfamiliar sites.
- Unexpected session activity on high-value web applications, such as logins or API calls from unusual geolocations following browser activity on unmanaged pages.
Detection Strategies
- Inventory Apple endpoints and correlate installed Safari and OS build numbers against Apple's fixed versions to identify exposed devices.
- Monitor browser telemetry and proxy logs for suspicious cross-origin traffic patterns, especially referrers that chain from unknown domains into authenticated SaaS applications.
- Track Debian-based systems consuming WebKit through package management, and confirm the Debian LTS Announcement update has been applied.
Monitoring Recommendations
- Enable centralized logging of web proxy and DNS traffic to detect exfiltration attempts to attacker-controlled domains.
- Alert on anomalous session reuse on identity providers and SaaS platforms that could indicate stolen cookie-derived data.
- Review endpoint management dashboards for macOS and iOS patch compliance metrics, escalating devices lagging behind the fixed builds.
How to Mitigate CVE-2024-54467
Immediate Actions Required
- Update Safari to version 18 on macOS releases where standalone updates apply, and update all Apple operating systems to the fixed builds.
- Enforce OS and browser update policies through MDM to prevent users from deferring updates on managed devices.
- Apply the Debian LTS WebKitGTK security update on affected Linux systems using the vulnerable WebKit build.
Patch Information
Apple resolved CVE-2024-54467 with improved state management in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, and watchOS 11. Refer to Apple Support Advisory #121240, Apple Support Advisory #121241, Apple Support Advisory #121248, Apple Support Advisory #121249, and Apple Support Advisory #121250 for platform-specific package versions.
Workarounds
- Restrict browsing to trusted sites and block newly registered or low-reputation domains at the web proxy until patches are deployed.
- Reduce persistent authentication exposure by shortening session lifetimes and requiring reauthentication for sensitive SaaS applications.
- Educate users to avoid clicking untrusted links on vulnerable Apple devices until updates are confirmed installed.
# Verify Safari and macOS versions on managed endpoints
sw_vers -productVersion
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
