# Hacking CloudKit - How I accidentally deleted your Apple Shortcuts

Misconfigured CloudKit public-scope permissions let an authenticated user forceDelete records and delete the _defaultZone, wiping all Apple Shortcuts shared links and gallery data.

- Payout: $28,000
- Severity: critical
- Program: Apple
- Credited: Frans Rosén
- Disclosed: 2021-09-13
- Write-up quality: 9/10
- Original: https://labs.detectify.com/2021/09/13/hacking-cloudkit-how-i-accidentally-deleted-your-apple-shortcuts/
- Library page: https://bugbountylibrary.com/r/blog%3Alabs-detectify-com-2021-09-13-hacking-cloudkit-how-i-accidentally-deleted-your-apple-shortcuts
- Tags: domain:cloud domain:web3 impact:dos impact:integrity kind:bounty platform:blog sev:critical tech:rest technique:recon technique:source-review vuln:access-control vuln:auth-bypass vuln:misconfiguration

**Target:** CloudKit public database API (p25-ckdatabasews, p55-ckdatabasews, gateway.icloud.com)
**Root cause:** Apple-owned CloudKit containers in the Public scope lacked proper permission checks: forceDelete bypassed record-level ACLs, and the _defaultZone could be deleted by any authenticated developer-portal user despite UI claiming custom zones aren't supported in Public scope.
**Steps:**
1. Enumerate Apple apps via jailbroken iPad proxy to find CloudKit containers (com.apple.shortcuts, com.apple.news.public, iCloud.com.apple.phonemo).
2. Obtain API token from public.icrowd.apple.com JS; use CloudKit Catalog to add records to public scope.
3. For Apple News: reuse www.icloud.com Notes session against `POST /database/1/com.apple.news.public/production/public/records/modify` with `operationType: forceDelete` to delete arbitrary Article/Tag/Stock records.
4. For Shortcuts: use icloud.developer.apple.com session against `POST /r/v4/user/com.apple.shortcuts/Production/public/records/modify?team_id=9DCADDBE3F`; Burp replace rule swaps own container for com.apple.shortcuts.
5. Send `POST /r/v4/user/com.apple.shortcuts/Production/public/zones/modify` with `{"operations":[{"purge":true,"zone":{"atomic":true,"zoneID":{"zoneName":"_defaultZone"}},"operationType":"delete"}]}`.
6. Response `{"deleted":true}`; zones/list still shows _defaultZone but all records inside are purged, breaking every shared shortcut link.
**How found:** Noticed Apple apps used CloudKit with multiple distinct APIs (p55, p25, gateway protobuf, api.apple-cloudkit.com). Hypothesized complex auth/roles were misconfigured internally. After forceDelete worked on News, tried every documented modify operation; tested zones last, expecting _defaultZone delete to fail like metadata_zone, but it succeeded.
**Exploitation:** Any authenticated Apple developer-portal user could target Apple-owned CloudKit containers by swapping the container ID in requests. forceDelete on public records removed arbitrary News articles/stocks; deleting _defaultZone purged all SharedShortcut and GalleryBanner records, causing 404s for every shared shortcut URL and emptying the Shortcuts gallery globally.
**Escalation:** Cross-API pivot: Notes session (p55) reached News container; developer-portal session (p25) reached Shortcuts container. Zone-creation success used as non-destructive indicator across 30+ other Apple containers.
**Insight:** When a platform exposes multiple front-end APIs to the same backend (web session, developer portal, protobuf gateway), auth checks often differ per path — replay a privileged session against another container by swapping the container ID. Also: undocumented operations (zone delete) may skip checks that documented ones enforce; use non-destructive probes (zone create) to confirm scope before destructive tests.