Researchers Hacked Apple Infrastructure Using SQL Injection

Researchers found several points of entry for potential attackers, one of which was Apple’s Book Travel portal, where they took advantage of a significant SQL injection vulnerability.

Experimenting with the Masa/Mura CMS revealed the attack surface, primarily the one available within Apple’s environment. 

The JSON API was the main focus because it provides access to certain functions available within Apple’s environment. A JSON API should be the source of any potentially susceptible sink researchers discover.

Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers

Identifying the Vulnerability Sink

In a blog post in ProjectDiscovery Cloud Platform, researchers explain how they focused SQL injection sink detection.

  • Parse each CFM/CFC file.
  • Go through each statement, select the statement if it’s a tag and its name is cfquery .
  • Strip all tags (like cfqueryparam) inside the code block of cfquery and if it still has arguments in the codeblock then the input is not parameterized and the query is susceptible to an SQL injection, given no other validation is in place.
  • Print this query.
getObjects was called within the dspObjects

A critical condition in the dspObjects function was found by researchers. An if condition needs to be met before invoking getObjects: the Mura servlet event handler’s isOnDisplay property needs to be set to true. 

At first, researchers thought that any property on the event handler could be set by just providing the property name and value as parameters. Their debugging session inside the codebase served as the foundation for this hypothesis.

The previewID property can be set to any value by supplying it as an argument, and this will cause the isOnDisplay property to be set to true.

“Since this was an error-based SQL injection, we could exploit it quite easily to achieve Remote Code Execution (RCE). Locally, we successfully performed RCE”, researchers said.

Researchers used these procedures to successfully conduct RCE:

  • Reset an Admin user’s password.
  • Obtain the reset token and user ID via SQL injection.
  • Use the password reset endpoint with exfiltrated info.
  • Utilize plugin installation to upload CFM files.

Disclosing the Findings

The researchers duly shared the findings with Apple and the corresponding Masa and Mura CMS teams.

Apple promptly addressed the stated issue by responding and implementing a fix within two hours of the initial report. 

Masa is an open-source fork of Mura CMS; they released a fixed version of Masa CMS with great transparency. 

The most recent security fixes, which address another critical pre-auth SQL injection and have been assigned CVE (CVE-2024-32640), are included in the 7.4.6, 7.3.13, and 7.2.8 versions.

After many attempts to contact the Mura team about these vulnerabilities via various communication methods, no response was received.

Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Node.js systeminformation Package Vulnerability Exposes Millions of Systems to RCE Attacks

A critical command injection vulnerability in the popular systeminformation npm package has recently been disclosed, exposing millions…

6 hours ago

Skuld Malware Using Weaponized Windows Utilities Packages To Deliver Malware

Researchers discovered a malware campaign targeting the npm ecosystem, distributing the Skuld info stealer through…

1 day ago

BellaCiao, A new .NET Malware With Advanced Sophisticated Techniques

An investigation revealed an intrusion in Asia involving the BellaCiao .NET malware, as the initial…

1 day ago

Malicious Apps On Amazon Appstore Records Screen And Interecpt OTP Verifications

A seemingly benign health app, "BMI CalculationVsn," was found on the Amazon App Store, which…

1 day ago

Lazarus Hackers Using New VNC Based Malware To Attack Organizations Worldwide

The Lazarus Group has recently employed a sophisticated attack, dubbed "Operation DreamJob," to target employees…

1 day ago

New Python NodeStealer Attacking Facebook Business To Steal Login Credentials

NodeStealer, initially a JavaScript-based malware, has evolved into a more sophisticated Python-based threat that targets…

1 day ago