CVE-2023-28205

HIGHCISA KEV

Apple Multiple Products WebKit Use-After-Free Vulnerability

Title source: CISA
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-28205 has a selected CVSS score of 8.8 (high); EIP currently links 2 repository PoCs. CISA lists CVE-2023-28205 in KEV.

Description

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Description source: CVE List

Exploitation context

Known exploitation

CISA KEV
Listed · Apr 10, 2023 · CISA
VulnCheck KEV
Listed · Apr 7, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
2

CISA SSVC decision

ExploitationActive
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 28, 2025 · Source: CVE List

Affected products and versions

4
ProductSourceVersion range

Multiple Products

Browse Apple / Multiple Products
CISAVersion data not supplied

Safari

Browse Apple / Safari
CVE ListBefore 16.4affected

iOS and iPadOS

Browse Apple / iOS and iPadOS
CVE ListBefore 15.7affected
Before 16.4affected

macOS

Browse Apple / macOS
CVE ListBefore 13.3affected

Proofs of concept

2

Repository PoCs

GitHubseregonwar/uaf-2023-28205Repository PoCby seregonwar8Exploit13 files

58.6 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a JavaScript exploit for CVE-2023-28205, a use-after-free vulnerability in Apple WebKit. It triggers the vulnerability by sending a crafted object graph via postMessage, forcing garbage collection during deserialization to create a dangling pointer, and then attempts to verify memory corruption through heap spraying and identity checks.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README describing a CVE-2023-28205 WebKit use-after-free vulnerability and a JavaScript PoC (poc.js) that triggers the vulnerability. The PoC code performs standard exploit-development actions: creating object structures, sending them via postMessage, forcing garbage collection, and probing for memory corruption. No concealed executable behavior, unrelated remote access, credential theft, persistence, or operator-directed harm is present. The code logs diagnostic information to localStorage and the console, which is consistent with a research PoC.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesJavaScript
Target softwareApple WebKit
Attack typesuse-after-freearbitrary code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively triggers a use-after-free vulnerability and includes logic to verify memory corruption, which is characteristic of an exploit. The README describes it as a proof of concept that triggers a UAF, and the JavaScript code implements the full trigger and post-exploitation verification steps.

README.md:14-20poc.js:188-320

Requirements

  • Victim must process maliciously crafted web content (e.g., visit a page hosting the exploit).README.md:3-5
  • Target must be a vulnerable version of WebKit (e.g., Safari < 16.4.1, iOS < 16.4.1).README.md:7-8

Observed behavior

  • Sends a deeply nested object graph containing Map and Date objects via postMessage to trigger recursive deserialization.poc.js:168-186poc.js:219
  • Forces garbage collection during deserialization to free objects still referenced by non-GC-scanned containers.poc.js:223README.md:14-20
  • Detects the use-after-free by observing a confused object (a Date with a specific marker) in the deserialized data.poc.js:228-244
  • In non-crash mode, performs heap spraying with replacement objects and verifies memory reuse by checking identity or property markers.poc.js:255-312
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

LocalStorage Logging
Payload withheldThe PoC persists diagnostic logs to localStorage under a fixed key, which is normal for a browser-based exploit PoC and does not constitute exfiltration or backdoor behavior.poc.js:16-55
Url Parameter Reading
Payload withheldThe PoC reads 'mode' and 'probe' from the URL query string to control behavior (crash vs. probe), which is typical for a configurable PoC and does not indicate hidden command-and-control.poc.js:6-14poc.js:64-75
Review boundaries

What the analysis did not establish

  • Only two of thirteen repository files were provided as text; the remaining eleven files are unclassified and may contain additional exploit logic or dependencies.
  • The evidence does not include the imported modules (e.g., utils.mjs, int64.mjs, mem.mjs), which may be required for full exploit functionality.
  • The analysis is based solely on static review of the provided source code; the code was not executed, and its reliability or effectiveness is not verified.
  • Only two of 13 repository files were provided as text; 11 files were omitted from the evidence packet. The omitted files are reported as unclassified and may contain additional content not reviewed.
  • Binary files were flagged but not analyzed; the evidence packet reports zero binary files, so this limitation is noted for completeness but does not affect the current review.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubntfargo/uaf-2023-28205Repository PoCby ntfargo17Not analyzed13 files

36.5 KiB

GitHub
PoC details

References

Showing 12 of 18