Apple Reportedly Patches XSS Vulnerability on iCloud's Website

by

In a blog post shared by ZDNet, security researcher Vishal Bharad claims that he found a bug that would have allowed a hacker to inject a virus or malicious script onto Apple's ‌iCloud‌ website.

24330f3b719ded3a3092a6ff695d8a34

According to Bharad, the vulnerability consisted of creating a Pages or Keynote document on the ‌iCloud‌ website with the name field containing the XSS payload. Sharing the document with another user, creating a change, saving, and then clicking "Browse All Versions" under Settings would have triggered the XSS payload.

Given the vulnerability revolved around the ‌iCloud‌ website, it's not linked to a recent software update and has reportedly been patched by Apple server-side. Bharad says he submitted the issue to Apple on August 7, 2020, and received a $5,000 bounty on October 9, 2020. We've reached out to Apple for comment and we'll update if we hear back.

Tags: security, iCloud
Related Forum: Apple Music, Apple Pay/Card, iCloud, Fitness+

Top Rated Comments

Razorpit Avatar
Razorpit
17 weeks ago
Good thing no one ever shares a Pages or Keynote document on iCloud. Could have been catastrophic! ?
Score: 8 Votes (Like | Disagree)
locovaca Avatar
locovaca
17 weeks ago

I joke about their usage in the real world, but I use Pages and Numbers regularly. It just feels like I'm the only one.
I use them exclusively. They work fine for local content creation and I just export to doc/excel when I need to share.
Score: 5 Votes (Like | Disagree)
wfulle Avatar
wfulle
17 weeks ago

Good thing no one ever shares a Pages or Keynote document on iCloud. Could have been catastrophic! ?
Maybe it would of been fixed faster if Apple made pages a real competitor to Docs and Word
Score: 4 Votes (Like | Disagree)
Razorpit Avatar
Razorpit
17 weeks ago

Maybe it would of been fixed faster if Apple made pages a real competitor to Docs and Word
I joke about their usage in the real world, but I use Pages and Numbers regularly. It just feels like I'm the only one.
Score: 3 Votes (Like | Disagree)
sdz Avatar
sdz
17 weeks ago

Good thing no one ever shares a Pages or Keynote document on iCloud. Could have been catastrophic! ?
Fantastically analyzed.
Score: 2 Votes (Like | Disagree)
wfulle Avatar
wfulle
17 weeks ago

I joke about their usage in the real world, but I use Pages and Numbers regularly. It just feels like I'm the only one.
I might actually try them again because I really do like the simplicity and maybe its gotten better.
Score: 1 Votes (Like | Disagree)
Read All Comments

Top Stories

macbook air orange

Apple Developing a Whole New Kind of MacBook Air

Monday June 21, 2021 2:15 am PDT by
Apple is believed to be working on a completely new, high-end version of the MacBook Air, according to recent reports. Bloomberg's Mark Gurman, who often reveals accurate insights into Apple's plans, has repeatedly discussed the company's work on a high-end MacBook Air. Apple analyst Ming-Chi Kuo and leaker Jon Prosser have also referred to a similar MacBook Air model. The high-end...
Read Full Article
iOS 15 Users Underwhelmed Feature

Users Underwhelmed by iOS 15 and iPadOS 15, Survey Suggests

Monday June 21, 2021 7:17 am PDT by
Users appear to be underwhelmed by Apple's upcoming iOS 15 and iPadOS 15 updates, according to the findings of a new survey by SellCell. The survey asked 3,000 iPhone and iPad users, evenly split between men and women, aged 18 or over in the United States, what they thought of iOS 15, iPadOS 15, and the naming of the upcoming iPhone 13 lineup. Over 50 percent of all of the survey's...
Read Full Article • 410 comments
purple iphone 12 and 12 mini

iPhone 12 Mini Production Reportedly Ended Earlier Than Expected Due to Relatively Low Sales

Monday June 21, 2021 7:07 am PDT by
Following widespread reports that the iPhone 12 mini has experienced poor sales performance, at least relative to other iPhone 12 models, Taiwanese research firm TrendForce today claimed that production of the device has already ended. According to TrendForce, the iPhone 12 mini "reached End-of-Life ahead of time" during the second quarter of 2021, suggesting that Apple will focus on selling ...
Read Full Article • 182 comments
Dark Sky App Featured

Apple Updates Dark Sky Weather App With Apple Watch Improvements and More

Tuesday June 22, 2021 11:58 am PDT by
Apple today updated the Dark Sky weather app for the first time since November with improved VoiceOver support and other bug fixes and performance improvements. In addition, Dark Sky complications on the Apple Watch now update more frequently. The full release notes for Dark Sky version 6.8.6:• Improved VoiceOver support • Complications on Apple Watch update more frequently •...
Read Full Article • 51 comments
iPhone 12 v Android 2020

Apple Executive Says Users Who Want App Sideloading Already Have That Option With Other Platforms

Wednesday June 23, 2021 5:07 am PDT by
Apple earlier today published a detailed report outlining in blatant terms the negative impact that sideloading would have on the iPhone and iPad, specifically calling out the impacts it would have on user privacy and security. Now, the company is continuing its PR push, with an executive noting in an interview that users who wish to sideload apps already have that option thanks to other...
Read Full Article • 375 comments
iOS Spam Calendar Feature

iCloud Users Continue to Be Plagued by Calendar Spam

Monday June 21, 2021 8:51 am PDT by
Despite previous attempts to put the situation at rest, some iCloud users continue to experience spam calendar invitations, causing their calendars to be filled with random events. The situation received widespread coverage in 2016, where Apple said that it was "actively working to address this issue" by "identifying and blocking suspicious senders." Victims are targeted in various ways. The ...
Read Full Article • 76 comments
primeday2020 feature3

Amazon Prime Day: The Best Apple Deals

Monday June 21, 2021 6:15 am PDT by
Amazon's annual Prime Day event has officially kicked off today, beginning 48 hours of discounts, offers, and tons of savings across Amazon's storefront. This includes everything from home electronics to clothing, jewelry, video games, movies, and much more. Note: MacRumors is an affiliate partner with these vendors. When you click a link and make a purchase, we may receive a small payment,...
Read Full Article • 23 comments
ios wifi settings

iOS Bug Causes Specific Network Name to Disable Wi-Fi on iPhones

Sunday June 20, 2021 4:15 am PDT by
A wireless network naming bug has been discovered in iOS that effectively disables an iPhone's ability to connect to Wi-Fi. Security researcher Carl Schou found that after joining a Wi-Fi network with the name "%p%s%s%s%s%n" his iPhone's Wi-Fi functionality was left "permanently disabled." Changing a hotspot's SSID did nothing to correct the problem, with even a reboot failing to make a...
Read Full Article • 146 comments
iphone 13 lineup dummy models

iPhone 13 Dummy Models Depict Repositioned Camera Modules

Wednesday June 23, 2021 4:12 am PDT by
New alleged dummy models of the upcoming iPhone 13, shared by leaker Sonny Dickson on Twitter, depict a modified camera layout on the standard iPhone 13 and iPhone 13 mini, with two lenses in a diagonal arrangement rather than the vertical arrangement seen on the iPhone 12 models. The dummy models generally line up with iPhone 13 schematics previously seen by MacRumors, which showed that the ...
Read Full Article • 68 comments
iphone 13 yellow

TrendForce: iPhone 13 Lineup Will Remain Limited to Maximum 512GB of Storage

Monday June 21, 2021 6:33 am PDT by
Apple will likely unveil its next-generation "iPhone 12s" or "iPhone 13" lineup in around two and a half months from now, and ahead of time, Taiwanese research firm TrendForce has outlined its expectations for the devices. A summary of TrendForce's expectations:Apple will unveil four new iPhones in September, including a mini model, a standard model, and two Pro models. September is the...
Read Full Article • 62 comments