Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs

Overview

Summary

Two endpoints serving in-house iOS application packages and manifests in Fleet's enterprise tier are reachable without a hard-to-guess token in the URL, allowing an unauthenticated attacker who can reach the Fleet server to download an in-house IPA by guessing sequential title identifiers.

Impact

By design, Apple's InstallEnterpriseApplication MDM command requires that the manifest URL be reachable by the managed device without a Fleet session, so these endpoints cannot enforce session-based authentication. Fleet's legacy MDM installer path mitigates this by embedding a random, hard-to-guess token in the URL; the in-house iOS app endpoints (added later) were always intended to use the same time-limited-token pattern but the mitigation was not yet in place.

The result is read-only disclosure of in-house IPA binaries and their metadata (bundle identifier, version, name) that an operator has deployed through Fleet. This is enterprise-tier only — the free tier returns fleet.ErrMissingLicense. There is no privilege escalation, write access, or impact on hosts not managed by Fleet.

Workarounds

If an immediate upgrade is not possible:

• Restrict network access to the Fleet server to trusted networks, as is typical for MDM deployments.
• Remove in-house iOS apps that contain sensitive material from Fleet; in-house app IPAs are intentionally reachable by managed devices and should not be relied on as a confidential distribution channel.
• Where available, configure CloudFront URL signing for software installers to limit the validity window of issued binary URLs.

For more information

If you have any questions or comments about this advisory:

Email us at [email protected] Join #fleet in osquery Slack

Credits

We thank @offset for responsibly reporting this issue.

Affected packages

• github.com/fleetdm/fleet/v4 < 4.87.0

Remediation

Upgrade to a patched release:

• github.com/fleetdm/fleet/v4 4.87.0