github.com/fleetdm/fleet: Unauthenticated denial of service via unbounded recursion in Apple MDM enrollment property list parsing

Summary

Fleet's Apple MDM enrollment endpoints parse a device information payload supplied by the client before the device is authenticated. The binary property list parser used for this payload resolved object references recursively with no depth or cycle limit. A small crafted payload (around 150 bytes) could force the parser into exponential allocation or infinite recursion, exhausting CPU and memory and crashing the Fleet server.

Impact

An unauthenticated attacker with network access to a Fleet server that has Apple MDM enabled could crash the server, causing a denial of service for the whole instance.

This vulnerability impacts availability only. There is:

• No exposure of sensitive data
• No authentication bypass
• No privilege escalation
• No integrity impact

This issue only affects Fleet instances with Apple MDM enabled.

Patches

Fleet v4.89.0 bounds the depth and size of property lists parsed from Apple MDM enrollment and check-in requests. Fleet v4.92.0 moves this protection into the upstream github.com/micromdm/plist parser (v0.3.0).

Workarounds

If upgrading immediately is not possible, restrict network access to the Apple MDM enrollment endpoints (/api/mdm/apple/enroll and /api/mdm/apple/account_driven_enroll) to trusted networks. Request size limits do not mitigate this issue because the malicious payload is small.

Credits

We thank @fuzzztf for responsibly reporting this issue.

For more information

If you have any questions or comments about this advisory:

Email us at [security@fleetdm.com](mailto:security@fleetdm.com)

Join #fleet in osquery Slack