AppleiOS 13.5.1 Resource Exposure Vulnerability

Product: Apple iOS
Manufacturer: Apple Inc.
Affected Version(s): 13.3.1, 13.5.1
Tested Version(s): 13.3.1, 13.5.1
Vulnerability Type: Exposure of Resource to Wrong Sphere (CWE-668)
Risk Level: Medium
Solution Status: Open
Manufacturer Notification: 2020-03-23
Solution Date: -
Public Disclosure: 2020-07-02
CVE Reference: Not yet assigned
Author of Advisory: Philipp Buchegger, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

iOS (formerly iPhone OS) is a mobile operating system created and
developed by Apple Inc. exclusively for its hardware. It is the
operating system that presently powers many of the company's mobile
devices, including the iPhone.

On a company device with DEP (Device Enrollment Program), it is possible
to enforce certain restrictions in order to separate company from
private data.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

It is possible to circumvent the copy & paste restriction from the
company profile to the private profile. Thus, it is possible to extract
attachments that can be previewed ("Quick Look") in the native Mail
client to any private app.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

The vulnerability can be demonstrated and reproduced in the following
way:

1. Receive a PDF document in the native Mail app via a managed Exchange
   profile

2. On a managed and restricted device, copying this document is not
   possible

3. Tap and hold the PDF document, select "Quick Look"/"Übersicht"

4. Open the "Share..." dialog

5. Copy the document - this was not permitted in the previous view

6. Paste it in any private app, for example in "Files";
   for further demonstration, the Adobe Acrobat app was used

7. Access the file locally with any installed app

8. Download the digital document (no screen dump, a perfect digital copy
   of the original document) as PDF via USB

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

SySS GmbH is not aware of a solution for this reported security
vulnerability.

Apple does not consider the described security issue to be a security
vulnerability and has not fixed it yet.