Medium CVSS 6.5 webkit Bypass 🔧 Commit mapped

Overview

Medium
Severity
6.5
CVSS
No
Exploited ITW
Fixed
Fix Status
DescriptionA maliciously crafted webpage may be able to fingerprint the user
ComponentWebKit Resources
Bug ClassBypass
Tracker262699
Fix commit89314de81d9b (WebKit/WebKit) +3/-0
CWECWE-200 (Information exposure)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CISA KEVNot listed
Creditedan anonymous researcher
Disclosed2024-01-22

Background

WebContent sandbox profile
The seatbelt (.sb) policy restricting what the sandboxed WebContent process may access.
file-read-metadata
A sandbox operation permitting stat-like reads of a file’s metadata (existence, size, timestamps) without reading contents.
Device fingerprinting
Deriving a stable per-device identifier from observable state to track a user across origins.

Root Cause Analysis

This is a sandbox-hardening fix, not a memory-safety bug.

The patch adds a single rule to the iOS WebContent sandbox profile (com.apple.WebKit.WebContent.sb.in): (deny file-read-metadata (literal "/private/var/db/MobileIdentityData/Version.plist")). Before the change, the profile did not deny access to this path, so the sandboxed WebContent process — which runs untrusted web content — was able to read metadata for /private/var/db/MobileIdentityData/Version.plist. That file is a stable, device-specific system artifact, and its metadata (e.g. presence, size, timestamps) is consistent per device and largely invariant across origins and sessions. The violated invariant is sandbox least-privilege: WebContent should not be able to observe stable device-identifying state that a webpage could turn into a fingerprint. By reading metadata of this file, a malicious page could derive a persistent identifier and correlate the user across sites, which matches the advisory’s ‘may be able to fingerprint the user’ impact.

The fix restores the invariant by explicitly denying file-read-metadata on that literal path, closing the side channel at the sandbox boundary. INFERENCE: the exact WebContent code path that reached the file (which API or probe a page used) is not in this diff — the patch only shows the policy rule — so the specific trigger is not established by the commit, only that the capability existed and was removed.

Key insight
The WebContent sandbox should deny access to stable device-identifying system files by default; an omitted deny rule is a fingerprinting side channel.

Attack Path

  1. Load a malicious webpage The victim visits an attacker-controlled page whose JavaScript runs in the sandboxed WebContent process.
  2. Probe the device-identifying file's metadata The page drives a code path in WebContent that stats/reads metadata of /private/var/db/MobileIdentityData/Version.plist, which the pre-patch sandbox allowed.
  3. Derive a stable identifier Metadata of this per-device system file is consistent across origins and sessions, yielding a value usable as a device fingerprint.
  4. Correlate the user across sites The attacker (and colluding sites) use the derived identifier to track the user without cookies or storage, defeating anti-tracking protections.

Impact Assessment

Privacy/least-privilege issue, not memory safety: WebContent could read metadata of a stable device file and derive a fingerprint, enabling cross-site tracking. Confined to information exposure; no code execution or sandbox escape.

Changed Functions

FunctionChangeNotes
com.apple.WebKit.WebContent.sb.in (sandbox profile)
Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in
modified Adds a `deny file-read-metadata` rule for the literal path /private/var/db/MobileIdentityData/Version.plist, removing WebContent's ability to read metadata of this device-identifying file.

Files Changed

  • Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in

Audit Directions

  • Other stable device files reachable from WebContent
    Diff the WebContent .sb profile against files whose metadata is per-device and stable (identity/provisioning plists); each readable one is a fingerprint source.
  • Metadata vs content reads
    Look for paths allowed for file-read-metadata but not file-read-data; even metadata-only access can leak stable identifiers.
diff --git a/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in b/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in
index 9734cf26a015..a37b59016703 100644
--- a/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in
+++ b/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in
@@ -37,6 +37,9 @@
 (allow process-info-codesignature)
 #endif
 
+(deny file-read-metadata
+    (literal "/private/var/db/MobileIdentityData/Version.plist"))
+
 ;;;
 ;;; The following rules were originally contained in 'common.sb'. We are duplicating them here so we can
 ;;; remove unneeded sandbox extensions.
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker.