CVE-2015-1092

Vulnerability

An XML External Entity (XXE) issue exists in NSXMLParser in the Foundation framework on Apple iOS versions prior to 8.3 and Apple TV versions prior to 7.2 [1][2]. The parser incorrectly handles external entity declarations, allowing them to be resolved when an entity reference is encountered. This enables a remote attacker to read arbitrary files on the affected device.

Exploitation

An attacker can exploit this vulnerability by delivering a crafted XML payload containing an external entity declaration and a corresponding entity reference to an application that uses NSXMLParser. The attack can be remote, and no authentication is required. User interaction (e.g., opening a malicious document or visiting a webpage) may be necessary to trigger parsing of the malicious XML.

Impact

Successful exploitation leads to information disclosure. An attacker can read arbitrary files from the device's filesystem, potentially including sensitive data such as credentials, configuration files, or personal information. The impact is limited to reading files; the attacker does not gain code execution or system-level privileges directly through this vulnerability.

Mitigation

Apple addressed this issue in iOS 8.3 and Apple TV 7.2 by modifying NSXMLParser to not load external entities across origins [1][2]. Users should update their devices to the latest available versions. No workaround is provided for unpatched versions.