CVE-2023-41991

CVE-2023-41991 is a critical software vulnerability discovered within Apple's Security framework, as part of an exploit chain that included two additional vulnerabilities (CVE-2023-41992 and CVE-2023-41993) found in the WebKit browser engine and Apple's kernel framework. These flaws were reported by researchers from Citizen Lab and Google's Threat Analysis Group (TAG) and were exploited to install the Predator spyware on iOS versions up to 16.6.1. The vulnerabilities also affected devices running iOS 17 prior to version 17.0.1 and iPadOS 17 prior to version 17.0.1. The identified vulnerabilities were exploited between May and September 2023 in a series of targeted attacks against former Egyptian MP Ahmed Eltantawy, who had announced his intentions to run for the Egyptian presidential election in 2024. The attackers used decoy SMS and WhatsApp messages to lure their target and leveraged these vulnerabilities to bypass signature validation with malicious apps or gain arbitrary code execution via maliciously crafted webpages. The exploitation involved network-based injection tactics, redirecting Eltantawy to malicious websites when he visited non-HTTPS sites. In response to these findings, Apple has promptly released security updates to address these three zero-day vulnerabilities. The patches underscore Apple's commitment to cybersecurity and its swift action to mitigate threats posed by these vulnerabilities. It is crucial for all users to update their devices to the latest software version to protect against potential exploitation of these vulnerabilities.