How Did I Easily Find Stored XSS at Apple and earn $5000 ?

Hello there ! Today we’ll talk about stored XSS which I found in Apple. Without further ado let’s get into it !

First of all, our vulnerable Apple service was: https://discussions.apple.com

This service is a community where Apple users and developers discuss their problems. By registering here you can open a profile for yourself and help people or get help from them !

Now let’s look at a simple example profile.

This is a simple profile I prepared for you. As you can see you can edit the “Location” and “Bio” section as you wish.

What If We Use A XSS Payload ?

Payload that will be used is :

We’ll place this payload in the “Location” section of our Apple profile and see the result together !

As you can see it’s a Stored XSS vulnerability that you can obtain very easily ! Cookies of users and staff could be stolen, and it was very simple to achieve that with this way !

As soon as I found something like this, I immediately contacted Apple Security via e-mail. At the end of our 3-month process, I received an e-mail like the one below and I was rewarded !

In this way I obtained the XSS vulnerability in Apple in a very simple way and completed it with great success ! I leave Apple’s Hall Of Fame list and my position on the list below for you.

https://support.apple.com/en-us/102812 (June 2022) (@xrypt0)

Thank you for reading and paying attention this far. Goodbye, see you in future articles !

Crypto (@xrypt0)