Intel

CVE-2024-44309

Red Hat Security Advisory: webkitgtk4 security update

criticalKEV: actively exploitedPoCEPSS 23%

Description

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

Source: REDHAT_CSAFCISA_KEVCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

Despite what may appear to be a moderate CVSS score at first glance, CVE-2024-44309 carries a very high operational risk: Apple has confirmed active exploitation on Intel-based Mac systems, and the EPSS score sits at the 97.6th percentile, indicating empirically high real-world exploitation probability. The flaw resides in WebKit's cookie-management logic, enabling XSS via crafted web content — a primitive that can be chained into session hijacking, credential theft, and lateral movement across web applications. For NIS2-regulated organisations with Mac fleets — particularly in financial services, healthcare, or critical infrastructure — the risk is elevated because privileged users routinely browse with Safari on macOS. The absence of a CISA ransomware flag suggests targeted delivery (e.g. spear-phishing with crafted links) rather than opportunistic mass exploitation, which makes high-value KRITIS targets a likely focus and reinforces the need for rapid patch deployment over broad compensating controls.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply vendor patches immediately: Push Apple updates to Safari 18.1.1, iOS 18.1.1 / iPadOS 18.1.1, macOS Sequoia 15.1.1, and visionOS 2.1.1 via MDM (Jamf, Microsoft Intune). For older device generations, the minimum target is iOS 17.7.2 / iPadOS 17.7.2. Do not rely on end-user self-service.
  • Prioritise Intel-based Mac systems: Apple explicitly confirms active exploitation on Intel-based Macs. Treat this device class as highest priority; consider isolating unpatched Intel Macs from the network or restricting Safari usage until the rollout is complete.
  • Remove Safari as the default browser on managed endpoints: Redirect users to an alternative browser (Firefox, Chrome) as a temporary measure until patch coverage reaches 100%.
  • Enforce MDM compliance policy: Mark devices below the minimum OS threshold (iOS < 18.1.1 / macOS < 15.1.1) as non-compliant and block their access to corporate resources (VPN, e-mail, intranet portals).
  • Invalidate active session tokens: Because the vulnerability is rooted in cookie management, force re-authentication for all active web sessions on critical applications (SSO, admin portals, privileged web tools) to eliminate any tokens that may have been hijacked.

Runbook · Step 2

Mitigation layers

  • Enforce strict Content-Security-Policy (CSP): Configure all internal web applications and reverse proxies to emit Content-Security-Policy: default-src 'self'; script-src 'self' — this limits XSS payload execution even on unpatched clients.
  • Activate WAF XSS and cookie-injection signatures: Enable relevant rule sets in your WAF (ModSecurity CRS, AWS WAF managed rules, Cloudflare WAF) targeting cookie injection patterns and DOM-manipulation payloads. Block or challenge requests with anomalous Set-Cookie headers.
  • Harden cookie attributes application-wide: Ensure all session cookies are issued with SameSite=Strict; Secure; HttpOnly — this significantly reduces the blast radius of a successful cookie-theft attempt.
  • Restrict privileged user browsing via proxy policy: Prevent admin and service accounts from accessing external or untrusted URLs through Safari using URL-category filtering on your web proxy.
  • Deploy Mobile Threat Defense (MTD) on iOS/iPadOS: Use an MTD solution (Jamf Protect, Microsoft Defender for Endpoint on iOS) to detect anomalous WebKit activity on mobile devices until patches are fully deployed.

Runbook · Step 3

Detection rules

  • MDM inventory report: Generate a daily report of devices running Safari < 18.1.1 or OS versions below the patch threshold. Automatically move non-compliant devices into a quarantine group.
  • Web server access logs — cookie anomalies: Search for requests where the Cookie: header contains unusually long or Base64-encoded values that may indicate injected payloads: grep -P 'Cookie:.*[A-Za-z0-9+/]{100,}={0,2}' access.log
  • Proxy/DNS telemetry — exfiltration domains: Correlate outbound DNS queries triggered by a WebKit process shortly after visiting an external URL against your domain allowlist (Zeek dns.log joined with http.log). Flag new or low-reputation domains.
  • EDR — anomalous WebKit child processes (macOS): Alert on unexpected child processes spawned by com.apple.WebKit.WebContent, especially shell or scripting interpreters. Sigma shape: ParentImage|endswith: 'WebContent' AND Image|endswith: ('sh','osascript','python3')
  • SIEM — session token reuse from multiple sources: Alert when the same session token is observed from more than one source IP or User-Agent within a short window. KQL shape: SessionToken == X AND distinct_count(src_ip) > 1 AND timespan < 5m

Metrics

Severity
critical
Priority score
218.77
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
—
CVSS v3
—
CVSS v4
—
EPSS percentile
97.6 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
22.6 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2025-07-07 02:28 UTC
CWE
—

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    redhat / enterprise_linux6.0

  • linux

    redhat / enterprise_linux7.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • macos

    apple / mac_os_x10.14.6

  • macos

    apple / mac_os_x10.15.7

  • macos

    apple / mac_os_x

  • macos

    apple / macos

  • macos

    apple / visionos

  • mobile

    apple / iphone_os

  • other

    fedoraproject / fedora32

  • other

    fedoraproject / fedora33

  • other

    fedoraproject / fedora35

  • other

    fedoraproject / fedora36

  • other

    fedoraproject / fedora37

  • other

    fedoraproject / fedora38

  • other

    fedoraproject / fedora39

  • other

    fedoraproject / fedora40

  • other

    apple / ipados

  • other

    apple / tvos

  • other

    apple / watchos

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apple

    safari14.1

  • apple

    safari14.1.1

  • apple

    safari15.3

  • apple

    safari15.6

  • apple

    safari15.6.1

  • apple

    safari16.0

  • apple

    safari16.2

  • apple

    safari16.3

  • apple

    safari16.4

  • apple

    safari16.4.1

  • apple

    safari16.5

  • apple

    safari16.5.1

  • apple

    safari16.5.2

  • apple

    safari17.0

  • apple

    safari17.1.2

  • apple

    safari17.2

  • apple

    safari17.6

  • apple

    safari18.0

  • apple

    safari18.2

  • apple

    safari18.4

  • bitnami

    jre1.9.0

  • google

    chrome124.0.6367.155

  • google

    chrome35.0.1916.113

  • google

    chrome

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

Show 205 more CVEs
IDCVE-2024-44309