Fleet MDM Unbounded Recursion in Apple MDM Enrollment Parsing

Executive Summary

Fleet before version 4.89.0 has an unbounded recursion flaw in Apple MDM enrollment property list parsing. Attackers can send a crafted 150-byte binary plist payload to enrollment endpoints, causing exponential memory allocation or infinite recursion. This exhausts CPU and memory resources, leading to a denial-of-service condition.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusual CPU or memory spikes on Fleet servers, particularly when processing Apple MDM enrollment requests. Check logs for repeated failed enrollment attempts or malformed binary plist payloads. Use network traffic analysis tools to detect suspicious payloads of around 150 bytes sent to MDM enrollment endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to remotely crash your Fleet server by sending a small malicious payload. The impact is limited to service availability; no data exposure, authentication bypass, or privilege escalation occurs. Systems with Apple MDM enabled are specifically affected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts system availability by causing server crashes through CPU and memory exhaustion. It does not expose sensitive data, bypass authentication, or affect integrity, so direct compliance violations for standards like GDPR or HIPAA are unlikely unless availability is a critical requirement for compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Fleet to version 4.89.0 or later to patch the vulnerability. If immediate upgrading is not possible, restrict network access to Apple MDM enrollment endpoints to trusted networks only.

Useful 0 Not Useful 0