CVE-2025-24203 PoC — Apple iPadOS 安全漏洞

Source

https://github.com/pxx917144686/iDevice_ZH

Associated Vulnerability

Title:Apple iPadOS 安全漏洞 (CVE-2025-24203)
Description:The issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to modify protected parts of the file system.

Description

CVE-2025-24203漏洞

Readme

## iDevice ？

基于Google Project Zero的Ian Beer发现的强大漏洞[CVE-2025-24203](https://project-zero.issues.chromium.org/issues/391518636)**无需越狱**进行系统级调整
- ✅ iOS 16.0 – iOS 18.3.2 使用CVE-2025-24203
- ✅ iOS 16.0 - 18.5 支持文件管理器和IPA调整注入器

<!-- 图片左右排列 -->
<div style="display: flex; justify-content: space-evenly; align-items: center; width: 100%; overflow: auto; gap: 40px;">
    <img src="./3.PNG" width="350" />
    <img src="./4.PNG" width="350" />
    <img src="./2.PNG" width="350" />
    <img src="./1.PNG" width="350" />
</div>

<hr style="border: 1px solid #ccc; margin: 20px 0;">

File Snapshot


 [4.0K]  /data/pocs/10172fbb1efe25f818f05028928da8de77804fa7
├── [408K]  1.PNG
├── [316K]  2.PNG
├── [218K]  3.PNG
├── [372K]  4.PNG
├── [4.0K]  CoreAppService
│   └── [ 257]  currentVer.json
├── [ 512]  ExportOptions.plist
├── [ 661]  iDevice-Toolkit-Info.plist
├── [4.0K]  iDevice_ZH
│   ├── [4.0K]  Assets.xcassets
│   │   ├── [4.0K]  AppIcon.appiconset
│   │   │   ├── [8.3K]  100.png
│   │   │   ├── [155K]  1024.png
│   │   │   ├── [8.4K]  102.png
│   │   │   ├── [9.2K]  108.png
│   │   │   ├── [9.7K]  114.png
│   │   │   ├── [ 10K]  120.png
│   │   │   ├── [ 11K]  128.png
│   │   │   ├── [ 13K]  144.png
│   │   │   ├── [ 13K]  152.png
│   │   │   ├── [ 15K]  167.png
│   │   │   ├── [ 781]  16.png
│   │   │   ├── [ 15K]  172.png
│   │   │   ├── [ 17K]  180.png
│   │   │   ├── [ 18K]  196.png
│   │   │   ├── [1.0K]  20.png
│   │   │   ├── [ 20K]  216.png
│   │   │   ├── [ 22K]  234.png
│   │   │   ├── [ 25K]  256.png
│   │   │   ├── [ 25K]  258.png
│   │   │   ├── [1.7K]  29.png
│   │   │   ├── [1.9K]  32.png
│   │   │   ├── [2.7K]  40.png
│   │   │   ├── [3.4K]  48.png
│   │   │   ├── [3.5K]  50.png
│   │   │   ├── [ 58K]  512.png
│   │   │   ├── [4.0K]  55.png
│   │   │   ├── [4.2K]  57.png
│   │   │   ├── [4.3K]  58.png
│   │   │   ├── [4.4K]  60.png
│   │   │   ├── [4.8K]  64.png
│   │   │   ├── [5.0K]  66.png
│   │   │   ├── [5.7K]  72.png
│   │   │   ├── [6.0K]  76.png
│   │   │   ├── [6.4K]  80.png
│   │   │   ├── [7.1K]  87.png
│   │   │   ├── [7.2K]  88.png
│   │   │   ├── [7.5K]  92.png
│   │   │   └── [6.7K]  Contents.json
│   │   └── [  63]  Contents.json
│   ├── [ 63K]  ContentView.swift
│   ├── [ 37K]  CustomTweakCreator.swift
│   ├── [5.5K]  CustomTweakManager.swift
│   ├── [4.2K]  default_tweaks.json
│   ├── [1.8K]  DocumentPickerStuff.swift
│   ├── [1.6K]  exploit.c
│   ├── [ 54K]  iDeviceFileUtil.swift
│   ├── [2.9K]  iDeviceLoggerView.swift
│   ├── [2.5K]  iDeviceToolbox.swift
│   ├── [  58]  iDevice_ZH-Bridge-Header.h
│   ├── [ 803]  TerminalLogger.swift
│   ├── [7.5K]  TweakService.swift
│   └── [ 12K]  UpdateService.swift
├── [4.0K]  iDevice_ZH.xcodeproj
│   ├── [ 13K]  project.pbxproj
│   ├── [4.0K]  project.xcworkspace
│   │   ├── [ 135]  contents.xcworkspacedata
│   │   ├── [4.0K]  xcshareddata
│   │   │   └── [4.0K]  swiftpm
│   │   │       └── [ 389]  Package.resolved
│   │   └── [4.0K]  xcuserdata
│   │       └── [4.0K]  geosn0w.xcuserdatad
│   │           └── [191K]  UserInterfaceState.xcuserstate
│   ├── [4.0K]  xcshareddata
│   │   └── [4.0K]  xcschemes
│   │       └── [2.8K]  iDevice_ZH.xcscheme
│   └── [4.0K]  xcuserdata
│       ├── [4.0K]  geosn0w.xcuserdatad
│       │   └── [4.0K]  xcschemes
│       │       └── [ 616]  xcschememanagement.plist
│       └── [4.0K]  skadz.xcuserdatad
│           └── [4.0K]  xcschemes
│               └── [ 344]  xcschememanagement.plist
├── [  90]  Podfile
├── [ 665]  README.md
├── [4.0K]  TweakRepo
│   └── [4.6K]  tweaks.json
└── [ 12K]  VM_BEHAVIOR_ZERO_WIRED_PAGES.c

18 directories, 70 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!