| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/fleetdm/fleet/v4 | < 4.87.0 | 4.87.0 |
| fleet | < 4.87.0 | 4.87.0 |
Two endpoints serving in-house iOS application packages and manifests in Fleet's enterprise tier are reachable without a hard-to-guess token in the URL, allowing an unauthenticated attacker who can reach the Fleet server to download an in-house IPA by guessing sequential title identifiers.
By design, Apple's InstallEnterpriseApplication MDM command requires that the manifest URL be reachable by the managed device without a Fleet session, so these endpoints cannot enforce session-based authentication. Fleet's legacy MDM installer path mitigates this by embedding a random, hard-to-guess token in the URL; the in-house iOS app endpoints (added later) were always intended to use the same time-limited-token pattern but the mitigation was not yet in place.
The result is read-only disclosure of in-house IPA binaries and their metadata (bundle identifier, version, name) that an operator has deployed through Fleet. This is enterprise-tier only — the free tier returns fleet.ErrMissingLicense. There is no privilege escalation, write access, or impact on hosts not managed by Fleet.
If an immediate upgrade is not possible:
If you have any questions or comments about this advisory:
Email us at [email protected] Join #fleet in osquery Slack
We thank @offset for responsibly reporting this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free