Document Title: =============== Apple (iTunes Notify) - Bypass & Persistent Vulnerability References (Source): ==================== https://www.vulnerability-lab.com/get_content.php?id=2024 Followup ID: 654962036 Vulnerability Magazine: https://www.vulnerability-db.com/?q=articles/2016/12/22/apple-ios-102-notify-function-vulnerable-attacks-idevice-itunes-appstore Release Date: ============= 2017-01-16 Vulnerability Laboratory ID (VL-ID): ==================================== 2024 Common Vulnerability Scoring System: ==================================== 3.8 Product & Service Introduction: =============================== iOS is a mobile operating system created and developed by Apple Inc. exclusively for its hardware. It is the operating system that presently powers many of the company's mobile devices, including the iPhone, iPad, and iPod touch. (Copy of the Homepage: https://en.wikipedia.org/wiki/IOS ) iTunes is a media player, media library, online radio broadcaster, and mobile device management application developed by Apple Inc. It is used to play, download, and organize digital downloads of music and video (as well as other types of media available on the iTunes Store) on personal computers running the macOS and Microsoft Windows operating systems. The iTunes Store is also available on the iPhone, iPad, and iPod Touch. Through the iTunes Store, users can purchase and download music, music videos, television shows, audiobooks, podcasts, movies, and movie rentals in some countries, and ringtones, available on the iPhone and iPod Touch (fourth generation onward). Application software for the iPhone, iPad and iPod Touch can be downloaded from the App Store. iTunes 12.5 is the most recent major version of iTunes, available for Mac OS X v10.9.5 or later and Windows 7 or later; it was released on September 13, 2016. iTunes 12.2 added Apple Music to the application, along with the Beats 1 radio station, and iTunes 12.5 offers a refinement of the Apple Music interface. (Copy of the Homepage: https://en.wikipedia.org/wiki/ITunes ) Abstract Advisory Information: ============================== The vulnerability laboratory core research team discovered a persistent input validation vulnerability and mail encode issue in the official apple itunes online service web-application. Vulnerability Disclosure Timeline: ================================== 2016-12-15: Researcher Notification & Coordination (Benjamin Kunz Mejri - Evolution Security GmbH) 2016-12-16: Vendor Notification (Apple Product Security Team) 2016-12-16: Vendor Response/Feedback (Apple Product Security Team) 2017-**-**: Vendor Fix/Patch (Apple Cupertino Service Developer Team) 2017-**-**: Security Acknowledgements (Apple Product Security Team) 2017-01-16: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Apple Product: iTunes & AppStore - Online Service (Web-Application) 2016 Q4 Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ A persistent input validation vulnerability and mail encode issue has been discovered in the official apple itunes online service web-application. The persistent vulnerability allows remote attackers to inject own malicious script codes to the application-side of the vulnerable module or function. The vulnerability is located in the new iTunes and Appstore `Notify` function for iOS 10 devices. The function does take the user credentials of the icloud or devicename values to perform the notify. The performed outgoing email of the new-itunes services has not parse mechanism for the user credentials streamed through the email client. Thus allows remote attackers to inject own malicious payloads to execute them within the introduction word line were the name is visible in the email body of the notify message. The request method is a sync via the device and the attack vector is persistent. The injection point are the user credentials of the `firstname` parameter and the execution point occurs in the outgoing email by the "@new.itunes.com" email sender. The same type of vulnerability has been disclosed already by our team in the invoices of the appstore and itunes in 2015. (Ref: https://www.vulnerability-lab.com/get_content.php?id=1512 ) The vulnerability can be exploited on restricted accessable ios devices to the main account holder inbox. The issue could be used as well to continue the calender spam activities. The security risk of the persistent input validation and mail encoding web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 3.8. Exploitation of the persistent input validation and mail encoding web vulnerability requires a low privilege apple (appstore/itunes) account and low or medium user interaction. Successful exploitation of the vulnerability results in session hijacking, persistent phishing attacks, persistent redirect to external sources and persistent manipulation of affected or connected service module context Vulnerable Module(s): [+] Notify (New Function) Vulnerable Paramter(s): [+] firstname & name Affected Module(s): [+] Outgoing Service Notify Email Body Affected Sender(s): [+] do_not_reply@new.itunes.com Proof of Concept (PoC): ======================= The persistent input validation and mail encode vulnerability can be exploited by remote attackers with low privilege user account and with low user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. PoC: Payload(s) >"