Loading vulnerability…
CVE-2024-44258 is an improper symbolic-link handling vulnerability in Managed Configuration. Restoring a maliciously crafted device backup can cause modification of protected system files. Apple addressed the issue through improved handling of symbolic links.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a Python-based Apple mobile device exploitation/restore utility named 'The Sparstan Boogie'. It is not a framework module; the main execution flow is main.py, which warns about bootloop risk and dispatches into bin/sparse.py. The README states the issue affects iOS/iPadOS 15.2 through 16.7 RC and 17.0, and was fixed in later Apple releases by improved symlink handling during backup restore. The stated impact is that restoring a maliciously crafted backup file can modify protected system files. Repository structure is small: README.md documents affected versions and example usage; requirements.txt declares pymobiledevice3; main.py is a thin launcher; bin/sparse.py contains the substantive exploit logic; bin/pyimod01_archive.py is a decompiled PyInstaller archive helper and appears ancillary rather than exploit-specific; bin/__pycache__/.sky is negligible. The code in sparse.py includes environment/bootstrap logic for Python 3.12, optional PyInstaller archive loading, dependency handling, async helpers, and the actual device interaction workflow. Operationally, the exploit appears to require a USB-connected, unlocked, trusted iPhone/iPad and uses pymobiledevice3 to communicate with the device. It enumerates/selects a replaceable built-in Apple app target (for example Tips, Calculator, Clock, etc.), resolves the target binary path, and invokes restore logic via functions such as restore_tips_app(from_path, to_path, lockdown). Error handling explicitly references device lock state, transient USB disconnects, and waiting for USB reconnection, reinforcing that this is a local/physical tethered exploit rather than a remote network exploit. The main exploit capability is deployment of an attacker-supplied crafted restore/backup payload from a local source path into a selected built-in app target on vulnerable Apple mobile OS versions, with the goal of modifying otherwise protected system files. The README example 'python3.12 main.py trollstorehelper --target Tips' suggests a practical use case of installing or restoring a helper payload into the Tips app container/path. Because the payload is operator-supplied and the tool performs the restore workflow, this is best characterized as an operational exploit utility rather than a mere proof-of-concept or detector.
This repository provides a conceptual proof-of-concept (PoC) for CVE-2024-44258, a symlink vulnerability in the iOS backup restoration process. The vulnerability allows an attacker to craft a backup containing a symlink, which, if not properly validated during restoration, could result in arbitrary file writes on the device, potentially leading to privilege escalation or unauthorized modification of critical files. The PoC consists of a single Python script ('poc-CVE-2024-44258.py') and a README.md with detailed instructions and background. The script simulates the creation of a malicious backup by generating the necessary directory structure and a payload .plist file, and attempts to restore it to a connected iOS device using 'idevicebackup2'. However, it does not implement the crucial step of modifying the 'Manifest.mbdb' file, which is required for a real exploit. As such, the PoC is non-functional for actual exploitation but is valuable for educational and research purposes, illustrating the mechanics of the vulnerability. The main attack vector is local, requiring physical access to the device and the ability to restore backups. The script requires user configuration of the symlink target path and is intended for use only on devices owned by the user for research. No network endpoints are involved; all operations are local to the device and host.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Symlink-handling issue during backup restore enabling modification of protected system files.
A Managed Configuration vulnerability where restoring a malicious backup may modify protected system files.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.