GHSA-q9c5-pp7m-fm2g: Medium severity go/github.com/fleetdm/fleet/v4 vulnerability
Summary
Two endpoints serving in-house iOS application packages and manifests in Fleet's enterprise tier are reachable without a hard-to-guess token in the URL, allowing an unauthenticated attacker who can reach the Fleet server to download an in-house IPA by guessing sequential title identifiers.
Impact
By design, Apple's InstallEnterpriseApplication MDM command requires that the manifest URL be reachable by the managed device without a Fleet session, so these endpoints cannot enforce session-based authentication. Fleet's legacy MDM installer path mitigates this by embedding a random, hard-to-guess token in the URL; the in-house iOS app endpoints (added later) were always intended to use the same time-limited-token pattern but the mitigation was not yet in place.
The result is read-only disclosure of in-house IPA binaries and their metadata (bundle identifier, version, name) that an operator has deployed through Fleet. This is enterprise-tier only — the free tier returns fleet.ErrMissingLicense. There is no privilege escalation, write access, or impact on hosts not managed by Fleet.
Workarounds
If an immediate upgrade is not possible:
- Restrict network access to the Fleet server to trusted networks, as is typical for MDM deployments. - Remove in-house iOS apps that contain sensitive material from Fleet; in-house app IPAs are intentionally reachable by managed devices and should not be relied on as a confidential distribution channel. - Where available, configure CloudFront URL signing for software installers to limit the validity window of issued binary URLs.
For more information
If you have any questions or comments about this advisory:
Email us at security@fleetdm.com Join #fleet in osquery Slack
Credits
We thank @offset for responsibly reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/fleetdm/fleet/v4to a version that resolves this vulnerability.Fixed in 4.87.0 - Compensating control
Remove in-house iOS app IPAs that contain sensitive material from Fleet, since the in-house app manifest/package endpoints are reachable by managed devices without relying on Fleet as a confidential distribution channel.
- Compensating control
Restrict network access to the Fleet server to trusted networks (typical MDM deployment practice), since the vulnerable endpoints are reachable without a hard-to-guess token.
- Compensating control
Where available, configure CloudFront URL signing for software installers to limit the validity window of issued binary URLs.
Event History
Frequently Asked Questions
Which deployments are affected?
Only Fleet Enterprise deployments are affected. The free tier returns fleet.ErrMissingLicense, and hosts not managed by Fleet are not impacted.
What does an attacker need to access the exposed application packages?
An attacker must be able to reach the Fleet server. No Fleet session or other authentication is required, and sequential title identifiers can be guessed to retrieve in-house iOS applications.
What can be disclosed through this issue?
The exposure is read-only and can disclose deployed in-house IPA binaries and associated metadata, including the bundle identifier, version, and application name. It does not provide write access or privilege escalation.