CVE-2024-23206

Overview

Impact:

Description: A maliciously crafted webpage may be able to fingerprint the user

Researchers: an anonymous researcher

Key insight. The WebContent sandbox should deny access to stable device-identifying system files by default; an omitted deny rule is a fingerprinting side channel.

Patch Details

diff --git a/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in b/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in
index 9734cf26a015..a37b59016703 100644
--- a/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in
+++ b/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in
@@ -37,6 +37,9 @@
 (allow process-info-codesignature)
 #endif
 
+(deny file-read-metadata
+    (literal "/private/var/db/MobileIdentityData/Version.plist"))
+
 ;;;
 ;;; The following rules were originally contained in 'common.sb'. We are duplicating them here so we can
 ;;; remove unneeded sandbox extensions.

Background

Advisory: Apple Security Advisory

Terminology

• WebContent sandbox profile — The seatbelt (.sb) policy restricting what the sandboxed WebContent process may access.
• file-read-metadata — A sandbox operation permitting stat-like reads of a file’s metadata (existence, size, timestamps) without reading contents.
• Device fingerprinting — Deriving a stable per-device identifier from observable state to track a user across origins.

Root Cause Analysis

This is a sandbox-hardening fix, not a memory-safety bug. The patch adds a single rule to the iOS WebContent sandbox profile (com.apple.WebKit.WebContent.sb.in): (deny file-read-metadata (literal "/private/var/db/MobileIdentityData/Version.plist")). Before the change, the profile did not deny access to this path, so the sandboxed WebContent process — which runs untrusted web content — was able to read metadata for /private/var/db/MobileIdentityData/Version.plist. That file is a stable, device-specific system artifact, and its metadata (e.g. presence, size, timestamps) is consistent per device and largely invariant across origins and sessions. The violated invariant is sandbox least-privilege: WebContent should not be able to observe stable device-identifying state that a webpage could turn into a fingerprint. By reading metadata of this file, a malicious page could derive a persistent identifier and correlate the user across sites, which matches the advisory’s ‘may be able to fingerprint the user’ impact. The fix restores the invariant by explicitly denying file-read-metadata on that literal path, closing the side channel at the sandbox boundary. INFERENCE: the exact WebContent code path that reached the file (which API or probe a page used) is not in this diff — the patch only shows the policy rule — so the specific trigger is not established by the commit, only that the capability existed and was removed.

Attack Path

1. Load a malicious webpage

The victim visits an attacker-controlled page whose JavaScript runs in the sandboxed WebContent process.

2. Probe the device-identifying file’s metadata

The page drives a code path in WebContent that stats/reads metadata of /private/var/db/MobileIdentityData/Version.plist, which the pre-patch sandbox allowed.

3. Derive a stable identifier

Metadata of this per-device system file is consistent across origins and sessions, yielding a value usable as a device fingerprint.

4. Correlate the user across sites

The attacker (and colluding sites) use the derived identifier to track the user without cookies or storage, defeating anti-tracking protections.

Impact Assessment

Privacy/least-privilege issue, not memory safety: WebContent could read metadata of a stable device file and derive a fingerprint, enabling cross-site tracking. Confined to information exposure; no code execution or sandbox escape.

Audit Directions

Other stable device files reachable from WebContent

Diff the WebContent .sb profile against files whose metadata is per-device and stable (identity/provisioning plists); each readable one is a fingerprint source.

Metadata vs content reads

Look for paths allowed for file-read-metadata but not file-read-data; even metadata-only access can leak stable identifiers.

Changed Functions

Files Changed

Source Files

• Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in