Apple CVEs — PoCs and detection rules¶
11 Apple vulnerabilities with detection-only proof-of-concept code and Docker labs; 11 ship ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache). For authorized testing and blue-team detection engineering.
| CVE | Severity | Detection / prevention | PoC |
|---|---|---|---|
| CVE-2024-23222 — Apple WebKit RCE | High (8.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-27860 — Apple AVEVideoEncoder | High (8.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-44308 — Apple WebKit RCE | High (8.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-23296 — Apple RTKit RCE | High (7.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-27804 — Apple Kernel EoP | High (7.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-23225 — Apple Kernel Read | High (7.1) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-44309 — Apple WebKit XSS | Medium (6.1) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-27834 — Apple WebKit Bypass | Medium (5.5) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-44204 — Apple VoiceOver | Medium (5.5) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-44243 — macOS SIP Bypass | Medium (5.5) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-44207 — Apple Messages | Medium (4.3) | Snort, YARA, Nginx, Apache | ✅ |