CVE-2025-24104

Published Jan 27, 2025

Last updated 2 months ago

Apple

iPadOS

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-24104 is a vulnerability in Apple's iOS and iPadOS stemming from improper handling of symbolic links (symlinks) during backup restoration. A specially crafted backup could allow an attacker to read arbitrary files outside the application sandbox, potentially exposing sensitive system data. This occurs because the `mc_mobile_tunnel` lockdown service doesn't validate whether the `CloudConfigurationDetails.plist` file is a symlink. If this file is replaced with a symlink pointing to a restricted file, the system reads the content of the targeted file instead, bypassing security restrictions. This vulnerability was discovered in April 2024 and reported to Apple in October 2024. Apple addressed the issue in iOS 18.3 beta 1 and iPadOS 17.7.4. The vulnerability allows reading arbitrary files, not modifying system files as initially reported by Apple. This highlights a significant security flaw in how backups are handled, potentially allowing unauthorized access to protected data.

Description: This issue was addressed with improved handling of symlinks. This issue is fixed in iPadOS 17.7.4, iOS 18.3 and iPadOS 18.3. Restoring a maliciously crafted backup file may lead to modification of protected system files.
Source: product-security@apple.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.5
Impact score: 3.6
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-59
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-59

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "27995710-C1F5-4919-8168-E2B59D7F698C",
            "versionEndExcluding": "17.7.4"
          },
          {
            "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AD29C5E9-9427-4C41-873F-C29493B892E4",
            "versionEndExcluding": "18.3",
            "versionStartIncluding": "18.0"
          },
          {
            "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "71A94ACA-8143-475F-8A89-8020B86CE80B",
            "versionEndExcluding": "18.3"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]