CVE Vulnerabilities

CVE-2025-24223

Cross-Site Request Forgery (CSRF)

Published: May 12, 2025 | Modified: May 27, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
8.8 IMPORTANT
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM

The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption.

Weakness

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Affected Software

Name Vendor Start Version End Version
Safari Apple * 18.5 (excluding)
Ipados Apple * 18.5 (excluding)
Iphone_os Apple * 18.5 (excluding)
Macos Apple * 15.5 (excluding)
Tvos Apple * 18.5 (excluding)
Visionos Apple * 2.5 (excluding)
Watchos Apple * 11.5 (excluding)
Red Hat Enterprise Linux 8 RedHat webkit2gtk3-0:2.38.5-1.el8_8.5 *
Red Hat Enterprise Linux 8.2 Advanced Update Support RedHat webkit2gtk3-0:2.46.3-1.el8_2 *
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support RedHat webkit2gtk3-0:2.46.3-1.el8_4 *
Red Hat Enterprise Linux 8.4 Telecommunications Update Service RedHat webkit2gtk3-0:2.46.3-1.el8_4 *
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions RedHat webkit2gtk3-0:2.46.3-1.el8_4 *
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support RedHat webkit2gtk3-0:2.46.3-1.el8_6 *
Red Hat Enterprise Linux 8.6 Telecommunications Update Service RedHat webkit2gtk3-0:2.46.3-1.el8_6 *
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions RedHat webkit2gtk3-0:2.46.3-1.el8_6 *
Red Hat Enterprise Linux 9 RedHat webkit2gtk3-0:2.38.5-1.el9_2.3 *
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions RedHat webkit2gtk3-0:2.46.1-1.el9_0 *
Qtwebkit-opensource-src Ubuntu esm-apps/bionic *
Qtwebkit-opensource-src Ubuntu esm-apps/focal *
Qtwebkit-opensource-src Ubuntu esm-apps/jammy *
Qtwebkit-opensource-src Ubuntu esm-apps/noble *
Qtwebkit-opensource-src Ubuntu esm-infra/xenial *
Qtwebkit-opensource-src Ubuntu focal *
Qtwebkit-opensource-src Ubuntu jammy *
Qtwebkit-opensource-src Ubuntu noble *
Qtwebkit-opensource-src Ubuntu oracular *
Qtwebkit-source Ubuntu esm-apps/bionic *
Qtwebkit-source Ubuntu esm-apps/xenial *
Webkit2gtk Ubuntu devel *
Webkit2gtk Ubuntu esm-infra/bionic *
Webkit2gtk Ubuntu esm-infra/xenial *
Webkit2gtk Ubuntu focal *
Webkit2gtk Ubuntu jammy *
Webkit2gtk Ubuntu noble *
Webkit2gtk Ubuntu oracular *
Webkit2gtk Ubuntu plucky *
Webkit2gtk Ubuntu upstream *
Webkitgtk Ubuntu esm-apps/bionic *
Webkitgtk Ubuntu esm-apps/xenial *
Wpewebkit Ubuntu esm-apps/focal *
Wpewebkit Ubuntu esm-apps/jammy *
Wpewebkit Ubuntu focal *
Wpewebkit Ubuntu jammy *

Potential Mitigations

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]
  • Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
  • Use the “double-submitted cookie” method as described by Felten and Zeller:
  • When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user’s machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.
  • Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.
  • This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]

References