Summary. The Apple Store at store.apple.com was vulnerable to a cross-site scripting issue that allowed reading the session cookie and, as a result, acting in the context of another logged-in user. The absence of any frame-busting protection on the affected page made the attack meaningfully easier. Apple confirmed and fixed the issue.
Background
The Apple Store at store.apple.com was vulnerable to a cross-site scripting issue that allowed reading the session cookie and, as a result, performing actions in the context of another logged-in user. The attack was made meaningfully easier by the absence of any frame-busting protection on the affected page.
Combined with framing, the same gap could be used to overlay content from an attacker-controlled server on top of the legitimate page, for example using HTML5 History API calls such as history.pushState() or history.replaceState(), to phish a visitor's Apple ID credentials.
Recommendation
Serving the X-Frame-Options header (sameorigin or deny) on every response prevents the page from being framed by a third party. Setting the HttpOnly flag on session cookies prevents them from being read via JavaScript in the first place, which would have closed off this particular impact even if the XSS itself had remained.
Disclosure
Apple confirmed and fixed the issue.