# Hacking the Apple Webcam (again)

ShareBear's icloud-sharing: scheme let a website plant a polymorphic file and auto-launch it, bypassing Gatekeeper to open a webarchive and achieve UXSS in Safari.

- Payout: $100,500
- Severity: high
- Program: Apple
- Credited: Ryan Pickren
- Disclosed: 2022-01-25
- CVE: CVE-2021-30861, CVE-2021-30975
- Write-up quality: 9/10
- Original: https://www.ryanpickren.com/safari-uxss
- Library page: https://bugbountylibrary.com/r/blog%3Aryanpickren-com-safari-uxss
- Tags: domain:browser impact:ato impact:data-leak kind:bounty platform:blog sev:high technique:chained technique:fuzzing technique:recon vuln:info-disclosure vuln:sandbox-escape vuln:xss

**Target:** Safari browser / ShareBear iCloud Sharing app / macOS Launch Services
**Root cause:** ShareBear auto-launches previously-approved shared files without re-prompting even after content/extension changes, and WebKit opened quarantined webarchives via a .url shortcut; a separate .sdef HTML renderer lacked SOP enforcement.
**Steps:**
1. Host page sets `location.href='icloud-sharing://www.icloud.com/iclouddrive/<id>'` to prompt victim to open a shared PNG.
2. After victim clicks Open, file lands in `~/Library/Mobile Documents/com~apple~CloudDocs` and is auto-launched on future icloud-sharing: navigations.
3. Attacker mutates the shared file server-side to `evil.dmg` containing `evil.webarchive`; ShareBear syncs and mounts it at `/Volumes/folder/evil.webarchive`.
4. Attacker swaps to `evil.url` containing `[InternetShortcut] URL=file:///Volumes/folder/evil.webarchive` and launches via icloud-sharing:.
5. Safari opens the webarchive, rendering attacker JS in the webarchive's declared origin (e.g. https://www.icloud.com) — UXSS.
6. Bonus: `icloud-sharing://example.com/photos/foo` opens arbitrary domain in a fresh unsandboxed tab, escaping iframe sandbox.
7. Bonus: package `evil.sdef` with HTML `<script>fetch('file:///etc/passwd')...` inside `evil.osax`; Script Editor renders it without SOP, leaking local files.
**How found:** Reviewed prior Safari UXSS work and Metasploit's 2013 webarchive note; enumerated Launch Services schemes via `lsregister -dump` cross-referenced with Safari's no-prompt allowlist, spotting undocumented `icloud-sharing:`; fuzzed the scheme to map ShareBear behavior and noticed the Open prompt grants persistent auto-launch of a mutable file.
**Exploitation:** Attacker convinces victim to click Open on a shared iCloud file once; thereafter the attacker-controlled file is silently synced and can be launched at will via the icloud-sharing: scheme. By mutating the file into a DMG (known mount path) and a .url shortcut pointing at a webarchive, Gatekeeper is bypassed and Safari renders attacker JS in an arbitrary origin, enabling camera access, cookie theft, and account takeover on any visited site.
**Escalation:** Chained design flaw (polymorphic auto-launch) + Gatekeeper bypass (.url shortcut) + DMG known-path mount + webarchive origin spoofing to convert a single user click into universal XSS across all origins; separate .osax/.sdef bug extends to local file theft.
**Insight:** Enumerate undocumented custom URI schemes with `lsregister -dump | grep apple-internal` and cross-reference Safari's no-prompt allowlist; any scheme that downloads-then-launches a file is a candidate for a polymorphic-file persistence primitive, and shortcut filetypes (.url, .webloc) can launder a blocked filetype past Gatekeeper by making an approved app open it.