Intel

CVE-2021-1871

Red Hat Security Advisory: webkitgtk4 security update

criticalKEV: actively exploitedPoCEPSS 7%

Description

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

Source: REDHAT_CSAFCISA_KEVNVDCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2021-1871 scores 9.8 on CVSSv3 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning a remote, unauthenticated attacker can achieve full code execution simply by serving a malicious web page — no user click beyond navigation is required. The EPSS score of 7.0 % places this in the 93.7th percentile, indicating a substantially elevated exploitation probability relative to the broader CVE population. Apple's own advisory acknowledged active exploitation at the time of release, which is the direct basis for CISA KEV inclusion. For NIS2-regulated organisations with mobile workforces — whether BYOD or corporate-owned iOS/macOS fleets — the risk is compounded by WebKit's system-wide role on Apple platforms: third-party apps that embed WKWebView are equally exposed. Prioritise patch deployment within 24 hours for all in-scope devices; treat any device that cannot receive the patch immediately as a critical isolation case.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply vendor patches immediately: Update iOS/iPadOS to 14.4 or later; update macOS Big Sur to 11.2, macOS Catalina with Security Update 2021-001 Catalina, macOS Mojave with Security Update 2021-001 Mojave. Push updates via MDM (e.g. Jamf, Microsoft Intune) — do not rely on voluntary user action.
  • Identify unpatched devices: Run an MDM compliance report or query Apple Business Manager to enumerate all managed Apple devices running iOS < 14.4 or macOS < 11.2 without Security Update 2021-001. Treat this list as your immediate remediation queue.
  • Isolate devices that cannot be patched immediately: Remove unpatched or unmanaged devices from corporate Wi-Fi and VPN until the patch is confirmed applied. Place them in a quarantine network segment with no access to internal resources.
  • Restrict Safari and WebKit-based browsing: On affected systems, disable Safari or block access to external web content via MDM restriction profile (allowSafari = false on iOS/iPadOS) until the patch is deployed. On macOS, set a non-WebKit browser (Firefox, Chrome) as the default.
  • Activate Mobile Threat Defense telemetry: If an MTD solution (e.g. Jamf Protect, Microsoft Defender for Endpoint on iOS) is deployed, verify real-time protection is active on affected devices and tighten alerting thresholds for anomalous WebKit process behaviour.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Move unpatched Apple devices into an isolated VLAN (quarantine Wi-Fi) with internet-only egress through a TLS-inspecting proxy — no lateral access to AD, file servers, or internal APIs.
  • TLS inspection and IPS rules: Route HTTPS traffic from Apple devices through a proxy with TLS inspection. Use Suricata/Snort to flag suspicious JavaScript delivery patterns. Starting-point Suricata rule: alert http any any -> any any (msg:"CVE-2021-1871 WebKit suspicious JS"; content:"<script"; http_client_body; pcre:"/eval\s*\(|unescape\s*\(/i"; sid:2021187101;) — tune to your environment before production use.
  • MDM configuration profile — browser lockdown: Deploy a Restrictions payload via MDM to disable Safari on iOS/iPadOS and prevent installation of unmanaged browsers until the patch is confirmed across the fleet.
  • Least-privilege certificate trust: Revoke or restrict trust of corporate CA certificates on unpatched devices to limit the blast radius if a device is compromised and used as a pivot point.
  • Email link rewriting: Configure the email gateway to rewrite URLs in messages delivered to mobile users through a safe-link service (e.g. Defender Safe Links, Proofpoint URL Defense) — reduces drive-by exploitation surface via email-borne links targeting WebKit.

Runbook · Step 3

Detection rules

  • MDM compliance alerting: Configure your MDM to alert on any device reporting iOS < 14.4 or macOS < 11.2 without Security Update 2021-001. Escalate daily compliance delta reports as tickets in your ITSM.
  • Proxy/DNS logs — exploit-kit domains: Search proxy or DNS logs for requests from Apple device user-agents to newly registered or low-reputation domains. SPL starting point: index=proxy dest_category="malicious" user_agent="*WebKit*" | stats count by src_ip, dest_domain | where count > 5.
  • EDR process ancestry on macOS: Alert on unusual child processes spawned by Safari, WebKit Web Content, or com.apple.WebKit.WebContent — especially sh, bash, python3, or osascript. Sigma shape: ParentImage|endswith: 'com.apple.WebKit.WebContent' AND Image|endswith: ('/bin/sh', '/bin/bash', 'osascript').
  • Network telemetry — post-exploitation callbacks: In Zeek or Suricata, correlate outbound connections from Apple devices to unknown external IPs on non-standard ports (not 80/443) occurring within seconds of a Safari page load — a potential indicator of a successful RCE callback.
  • iOS crash log collection: Collect WebContent and SafariServices crash reports from MDM-managed devices. Repeated crashes of these processes on the same device may indicate failed or in-progress exploit attempts before a successful execution.

Metrics

Severity
critical
Priority score
218.77
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
9.8
Source: nvd-v3
CVSS v3
9.8
CVSS v4
—
EPSS percentile
93.8 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
7.0 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2025-07-07 02:28 UTC
CWE
—

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    redhat / enterprise_linux6.0

  • linux

    redhat / enterprise_linux7.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • macos

    apple / mac_os_x10.14.6

  • macos

    apple / mac_os_x10.15.7

  • macos

    apple / mac_os_x

  • macos

    apple / macos

  • macos

    apple / visionos

  • mobile

    apple / iphone_os

  • other

    fedoraproject / fedora32

  • other

    fedoraproject / fedora33

  • other

    fedoraproject / fedora35

  • other

    fedoraproject / fedora36

  • other

    fedoraproject / fedora37

  • other

    fedoraproject / fedora38

  • other

    fedoraproject / fedora39

  • other

    fedoraproject / fedora40

  • other

    apple / ipados

  • other

    apple / tvos

  • other

    apple / watchos

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apple

    safari14.1

  • apple

    safari14.1.1

  • apple

    safari15.3

  • apple

    safari15.6

  • apple

    safari15.6.1

  • apple

    safari16.0

  • apple

    safari16.2

  • apple

    safari16.3

  • apple

    safari16.4

  • apple

    safari16.4.1

  • apple

    safari16.5

  • apple

    safari16.5.1

  • apple

    safari16.5.2

  • apple

    safari17.0

  • apple

    safari17.1.2

  • apple

    safari17.2

  • apple

    safari17.6

  • apple

    safari18.0

  • apple

    safari18.2

  • apple

    safari18.4

  • bitnami

    jre1.9.0

  • google

    chrome124.0.6367.155

  • google

    chrome35.0.1916.113

  • google

    chrome

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

Show 205 more CVEs
IDCVE-2021-1871