CVE-2023-41993
HIGH KEViPadOS < 17.0.1 - Remote Code Execution via Web Content Processing
Title source: llmExploitation Summary
CVE-2023-41993 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added September 25, 2023. EIP tracks 4 public exploits from researchers including po6ix, hrtowii, 0x06060606.
AI-analyzed exploit summary This repository contains a functional PoC exploit for CVE-2023-41993, targeting a type confusion vulnerability in WebKit's JavaScript engine. The exploit leverages offset confusion in GetByOffset nodes to achieve arbitrary read/write primitives, though it is noted to be unreliable and requires structure ID spraying for consistency.
Description
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
Exploits (4)
This repository contains a functional PoC exploit for CVE-2023-41993, targeting a type confusion vulnerability in WebKit's JavaScript engine. The exploit leverages offset confusion in GetByOffset nodes to achieve arbitrary read/write primitives, though it is noted to be unreliable and requires structure ID spraying for consistency.
This repository contains a functional exploit PoC for CVE-2023-41993, leveraging JavaScript-based memory manipulation utilities (Int64 and Struct) to exploit a vulnerability in WebKit. The code includes arithmetic operations and memory handling functions typical of browser exploitation techniques.
This repository contains a functional Proof of Concept (PoC) exploit for CVE-2023-41993, a critical vulnerability in the WebKit browser engine affecting Apple products. The PoC demonstrates limited read/write primitives and includes a server component to host the exploit.
The repository contains only a README with minimal details about CVE-2023-41993, mentioning it is a PoC but lacks actual exploit code. It notes the exploit is incomplete and unreliable, suggesting further development is needed.
References (7)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H