+92 303 800 1800   

Reflective Cross Site Scripting (XSS) Bug in Apple iCloud.com/#Mail

Apple is one of biggest companies in IT, and personally because of Steve Jobs, Apple was one of my favorite companies to be acknowledged by. As Apple is a very big organization and it has many products, therefore it wasn’t very hard to find a bug in Apple Products to be enlisted on Apple HOF.

Steps to reproduce the Non-Persistent XSS Vulnerability:
1: Login to http://icloud.com
2: Navigate to mail [https://www.icloud.com/#mail]
3: Create a folder with a payload as name
4: Create another Folder with same payload name.
4.1 When two folders with same name will be created, there will be an error message to alert about existing folder with same name. However that part wasn’t properly sanitized. So, in error it showed something like

“A folder with the name “> already exists” and a pop-up message executes as well.

Non-Persistent Cross Site Scripting in iCloud #Mail #Apple

And Apple fixed the bug by properly sanitizing the part, so now results for the same inputs are as following:

 
XSS Fixed by Apple for iCloud #Mail

Reward:

Reported: June  17, 2013
Confirmation for Bug Fixed: September 06, 2013
HOF Date: August 14, 2013 (Though the HOF wasn’t updated till mid of December, when I last checked)
I checked HOF: January 06, 2014

© 2018. All Rights Reserved!