Hacking CloudKit: How I accidentally deleted your Apple shortcuts

by xhruso00on 9/13/2021, 7:15:49 PM with 2 comments
  • by chrisandchrison 9/14/2021, 5:08:39 AM

    > But remember that I mentioned different APIs talked with CloudKit differently?

    As this sentence is the cause of most the bugs in the post I begin to question how they implemented their gateway so that a different endpoint results in a totally different authorization scope. That just screams „auth bug“.

  • by epagaon 9/14/2021, 5:58:08 AM

    Wow, I remember this happening! That is truly funny to me that it was because of a security researcher accidentally triggering this massive bug.

    Great write up, and kudos to apple for not suing him but paying out the bug bounties.