CVE-2023-41074 - How a WebKit Bug Could Let Hackers Take Control

CVE-2023-41074 is a high-impact vulnerability that shook the Apple ecosystem in late 2023. This bug was found in WebKit, the browser engine that powers Safari and many third-party apps on Apple devices. Successfully exploiting this flaw could let attackers execute arbitrary code simply by processing malicious web content — basically, just opening a booby-trapped website could compromise your device. In this post, we break down how the vulnerability works, show a simplified exploit idea, and explain how Apple fixed the problem and where you can learn more.

What is WebKit?

WebKit is the “engine” that Safari (and many other Apple apps) use to display web pages. It's also used in any iOS browser, thanks to Apple's App Store requirements.

What Went Wrong?

At its core, CVE-2023-41074 is a security bug in the way WebKit processed certain web content. The details are technical, but the bottom line is: a problem in the code meant a specially crafted webpage could confuse WebKit, resulting in arbitrary code execution — basically, running code the attacker chooses.

This could let an attacker install malware, spy on you, or steal your data — all just from visiting a website.

Here’s how Apple described the bug

> *Impact: Processing web content may lead to arbitrary code execution.*
>
> *Description: The issue was addressed with improved checks.*

Exploit Example: How Could an Attacker Use This?

The CVE report doesn't give a public proof-of-concept, but based on similar WebKit bugs, an exploit might look like this:

- The attacker crafts a malicious HTML or JavaScript file exploiting the bug (e.g., through a memory corruption, type confusion, or use-after-free condition).

When WebKit processes the content, the bug lets the attacker run their own code.

Let’s say the flaw allowed a JavaScript out-of-bounds write. Here’s a rough idea of how someone might approach exploitation (pseudo-code, not directly runnable):

// NOT a real exploit, for educational analogy only

// Spray memory with objects so corrupted data lands where the attacker wants
let arr = [];
for (let i = ; i < 10000; i++) {
  arr.push({payload: 'AAAA', foo: i});
}

// Trigger the vulnerability (pretend 'vulnerableFunction' processes web content in an unsafe way)
vulnerableFunction(arr);

// Now, the attacker might corrupt a function pointer or object, gaining arbitrary code execution
// In practice, real exploits are much more complex!

Note: Real-world attacks are far trickier. This is just to illustrate how memory bugs work.

Safari (on macOS, even if you’re not running Sonoma yet)

Any system that hadn’t yet received the patch was vulnerable.

How Did Apple Fix It?

According to Apple’s release notes, they fixed it by adding improved checks in the WebKit code. This likely means the developers:

Here’s a toy example in C/C++ for what a “check” might look like (code not from Apple)

// Before patch:
void processContent(char* input) {
  char buf[256];
  strcpy(buf, input); // Unsafe!
}
// After patch:
void processContent(char* input) {
  char buf[256];
  strncpy(buf, input, 255); // Limit input size!
  buf[255] = '\';
}

In WebKit's real code, this might involve checking object types, sizes, or permission flags.

Update your devices!

- Update your iPhone/iPad
- Update your Mac
- Update your Apple TV
- Update your Apple Watch

Responsible Disclosure & References

- Apple security updates for September 2023
- CVE-2023-41074 record at MITRE
- Apple WebKit upstream fixes

Bottom Line

CVE-2023-41074 is a textbook example of why it’s crucial to keep your software updated. Even the most secure platforms sometimes ship with critical vulnerabilities that can be exploited just by browsing the web. As soon as you can, upgrade to the latest Safari, iOS, macOS, watchOS, and tvOS versions.

Timeline

Published on: 09/27/2023 15:19:26 UTC
Last modified on: 10/20/2023 20:14:36 UTC