# We Hacked Apple for 3 Months: Here’s What We Found

Multi-bug Apple engagement: default Jive password auth bypass, DELMIA Apriso auth bypass, wormable iCloud Mail stored XSS, and command injection in Books for Authors.

- Payout: unconfirmed
- Severity: critical
- Program: Apple
- Credited: Sam Curry
- Disclosed: 2020-10-07
- Write-up quality: 8/10
- Original: https://samcurry.net/hacking-apple/
- Library page: https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-apple
- Tags: domain:web impact:ato impact:data-leak impact:rce kind:research platform:research sev:critical tech:aws technique:chained vuln:access-control vuln:auth-bypass vuln:command-injection vuln:ssrf vuln:xss

**Target:** Apple web infrastructure (ade.apple.com, colormasters.apple.com, www.icloud.com, authors.apple.com, banners.itunes.apple.com)
**Root cause:** Multiple: hidden default Jive password plus /admin;/ path bypass; Apriso auto-login reset-password user minting API bearer; iCloud Mail client-side sanitizer confused by split style tags and hyperlink/script-tag removal; providerId concatenated into Transporter shell command.
**Steps:**
1. ADE: register via application form, observe hidden `password=###INvALID#%!3`
2. POST to `cs_login` with default password, brute-force 1-3 char usernames via Burp Intruder
3. Access `/admin;/` (semicolon path bypass) to reach Jive admin console, upload plugin for RCE
4. Apriso: click Reset Password to be auto-authenticated as 'Apple No Password User', request OAuth bearer
5. GET `/Apriso/HttpServices/api/platform/1/Operations` to enumerate ~5000 calls, POST `APL_CreateEmployee_SO` with `{"inputs":{...}}` to create global admin
6. iCloud XSS: send email `<style></sty</style><style>le><script>alert(1)</script></style>`
7. Hyperlink XSS: send `https://www.icloud.com/mail/#<script></script>https://www.icloud.com/onmouseover=location=/javascript:alert%28document.domain%29/.source;//`
8. Authors: POST `/api/v1/validate/epub` with `"providerId":"...||test123"` for command injection
9. Banner SSRF: inject book title XSS, PhantomJS renders, iframe to `http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance`
**How found:** Noticed hidden default password identical across registrations, hypothesized manual Jive login; Apriso auto-login on reset-password page prompted OAuth bearer exploration; iCloud Mail client-side sanitization led to style-tag concatenation and hyperlink/script-removal confusion testing; help docs led to Books for Authors epub validator; banner path traversal revealed S3/PhantomJS rendering.
**Exploitation:** ADE: default password login as approved user then admin, plugin upload RCE. Apriso: bearer from reset-password session calls create-employee API to mint global admin. iCloud XSS: JS reads iCloud APIs, exfiltrates photos/contacts via self-addressed email to bypass CSP, worms to contacts. Authors: shell metacharacters in providerId execute commands. Banner: PhantomJS SSRF to AWS metadata leaks EC2/IAM keys.
**Escalation:** Chained auth bypass to admin console to RCE; XSS to wormable iCloud data theft; SSRF to internal Maven source code; PhantomJS XSS to AWS credential theft.
**Insight:** When a sanitizer removes tags like <script>, the resulting void can supply whitespace/characters that reset a parser state without closing it — combine tag-removal with auto-hyperlinking to smuggle event handlers. Also: hidden default passwords in registration forms and semicolon path variants (`/admin;/`) routinely bypass auth and path ACLs.