Actively Exploited in the Wild
This vulnerability is being actively exploited in the wild.
AirKeyboard iOS App Missing Authentication Vulnerability Allowing Remote Input Control
Vulnerability
A missing authentication vulnerability has been identified in the AirKeyboard iOS app version 1.0.5. This vulnerability allows unauthenticated attackers to inject arbitrary keystrokes into the victim's iOS device in real-time, without any user interaction. The issue arises from the app's WebSocket server, which is exposed on port 8888 and accepts input injection messages from any client. As a result, attackers can gain full remote control over input on the affected device.
Impact
Exploitation of this vulnerability leads to unauthorized remote input control on the victim's iOS device, allowing attackers to type anything as if they were the user.
Reproduction
To reproduce this vulnerability, connect to the same local network as the target iOS device running AirKeyboard version 1.0.5. Then, send a WebSocket message to the device's WebSocket server on port 8888. The message can be crafted to simulate keystrokes, which will be injected into the device in real-time without user interaction.
Remediation
Users are advised to update to the latest version of the AirKeyboard iOS app, if available.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.