Hi seclists! I wanted to try posting some of my research here, and I think this is the right list.
I recently published some research into Apple ID security that culminated in an XSS on the Apple ID server -- that is, an attacker can pop out an Apple login page that autofills your credentials and 2FA :) In particular, it has several really interesting components in the chain: - a Content Security Policy injection / bypass to slacken Javascript code execution and embed restrictions - bypass to postMessage restrictions on sending and receiving messages that uses some deep diving into the relevant spec - several bugs that involve interpretation malleability of URLs I was surprised to find out that postMessage's 'targetOrigin' parameter does not, as the spec describes, take a target origin, but actually a target *URL* which is then *parsed* to extract an origin. This means that, say 'https://nonsense:morenonse...@apple.com/somepath?nonsense#nonsense' as a *targetOrigin* will match 'https://apple.com'. The full write-up can be found here: https://zemnmez.medium.com/how-to-hack-apple-id-f3cc9b483a41 Thomas _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
