Unbounded Recursion in Apple MDM Enrollment Plist Parsing

Fleet before version 4.89.0 contains a critical denial-of-service vulnerability in its Apple Mobile Device Management (MDM) enrollment endpoint. The flaw stems from improper handling of recursively nested property list (plist) structures during parsing, allowing unauthenticated attackers to craft minimal payloads (~150 bytes) that trigger exponential resource consumption. This vulnerability affects any organization using Fleet for MDM-based device management, particularly those managing Apple device fleets at scale. Because the endpoint is typically exposed during enrollment processes and requires no authentication, the attack surface is substantial—any threat actor can crash the Fleet server without credentials, disrupting device management operations and potentially causing widespread service outages.

While MITRE ATT&CK techniques are not formally mapped to this CVE, Casky's security skills would detect exploitation patterns consistent with Resource Exhaustion and Availability attacks. Practitioners using Casky would identify suspicious activity through anomalous plist parsing requests to enrollment endpoints, detection of deeply nested binary structures in MDM traffic, and correlation of server crashes with small payload deliveries. The platform's extended reasoning capabilities would help security teams recognize that legitimate MDM enrollment requests follow predictable structural patterns—and flag deviations as potential attacks. By mapping this vulnerability against Casky's 754 security skills, organizations can establish behavioral baselines for enrollment traffic and detect the characteristic CPU/memory spikes that precede service failures, enabling rapid response before infrastructure impact.